Analysis
-
max time kernel
170s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 04:38
Behavioral task
behavioral1
Sample
270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe
Resource
win10v2004-20220414-en
General
-
Target
270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe
-
Size
43KB
-
MD5
e0d3981505e0eb41a2cb8288fda18a5f
-
SHA1
b66ce0206b377a20f8b1b04139e02a394078c99a
-
SHA256
270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
-
SHA512
8654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.ngrok.io:14007
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Dllhost.exeServer.exeServer.exepid process 1192 Dllhost.exe 1336 Server.exe 748 Server.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Loads dropped DLL 1 IoCs
Processes:
270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exepid process 1084 270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Dllhost.exepid process 1192 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe Token: 33 1192 Dllhost.exe Token: SeIncBasePriorityPrivilege 1192 Dllhost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exeDllhost.exetaskeng.exedescription pid process target process PID 1084 wrote to memory of 1192 1084 270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe Dllhost.exe PID 1084 wrote to memory of 1192 1084 270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe Dllhost.exe PID 1084 wrote to memory of 1192 1084 270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe Dllhost.exe PID 1084 wrote to memory of 1192 1084 270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe Dllhost.exe PID 1192 wrote to memory of 1752 1192 Dllhost.exe schtasks.exe PID 1192 wrote to memory of 1752 1192 Dllhost.exe schtasks.exe PID 1192 wrote to memory of 1752 1192 Dllhost.exe schtasks.exe PID 1192 wrote to memory of 1752 1192 Dllhost.exe schtasks.exe PID 896 wrote to memory of 1336 896 taskeng.exe Server.exe PID 896 wrote to memory of 1336 896 taskeng.exe Server.exe PID 896 wrote to memory of 1336 896 taskeng.exe Server.exe PID 896 wrote to memory of 1336 896 taskeng.exe Server.exe PID 896 wrote to memory of 748 896 taskeng.exe Server.exe PID 896 wrote to memory of 748 896 taskeng.exe Server.exe PID 896 wrote to memory of 748 896 taskeng.exe Server.exe PID 896 wrote to memory of 748 896 taskeng.exe Server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe"C:\Users\Admin\AppData\Local\Temp\270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {E24AD97B-486C-494A-A76C-E7B28D1731AD} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5e0d3981505e0eb41a2cb8288fda18a5f
SHA1b66ce0206b377a20f8b1b04139e02a394078c99a
SHA256270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
SHA5128654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5e0d3981505e0eb41a2cb8288fda18a5f
SHA1b66ce0206b377a20f8b1b04139e02a394078c99a
SHA256270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
SHA5128654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5e0d3981505e0eb41a2cb8288fda18a5f
SHA1b66ce0206b377a20f8b1b04139e02a394078c99a
SHA256270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
SHA5128654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD5e0d3981505e0eb41a2cb8288fda18a5f
SHA1b66ce0206b377a20f8b1b04139e02a394078c99a
SHA256270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
SHA5128654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD5e0d3981505e0eb41a2cb8288fda18a5f
SHA1b66ce0206b377a20f8b1b04139e02a394078c99a
SHA256270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
SHA5128654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
-
\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD5e0d3981505e0eb41a2cb8288fda18a5f
SHA1b66ce0206b377a20f8b1b04139e02a394078c99a
SHA256270a044c112fce9612bf852ea1bcaf7b1968148663832b942cc9057550c53c20
SHA5128654bab2a93affdde1218315f3943eb26e771796b535b9f7c818efce6b8d0c1e456adb1587114622184d128727ca6ffb41f7e894b082f00c06982d4c3578ede9
-
memory/748-69-0x0000000001000000-0x0000000001012000-memory.dmpFilesize
72KB
-
memory/748-67-0x0000000000000000-mapping.dmp
-
memory/1084-55-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/1084-54-0x0000000000290000-0x00000000002A2000-memory.dmpFilesize
72KB
-
memory/1192-60-0x0000000000CF0000-0x0000000000D02000-memory.dmpFilesize
72KB
-
memory/1192-57-0x0000000000000000-mapping.dmp
-
memory/1336-66-0x0000000000330000-0x0000000000342000-memory.dmpFilesize
72KB
-
memory/1336-64-0x0000000000000000-mapping.dmp
-
memory/1752-62-0x0000000000000000-mapping.dmp