Analysis
-
max time kernel
152s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:15
Behavioral task
behavioral1
Sample
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe
Resource
win10v2004-20220414-en
General
-
Target
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe
-
Size
43KB
-
MD5
71152f3b9a20b6bdf15451f7fefceeb5
-
SHA1
f1bfb4bbf23866b97cee0fb39895f365377003e9
-
SHA256
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e
-
SHA512
1efcb54168dd7abeefd5fd74147d86d8131ccb75c70b4c24673af88df4781577d31278ea8148ad061fc1177e5f9f71bdbc31e5528b7b5067ced19467bce36fb7
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
???
127.0.0.1:6626
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Dllhost.exeServer.exeServer.exepid process 856 Dllhost.exe 4348 Server.exe 4376 Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exeDllhost.exeServer.exepid process 4160 db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe 856 Dllhost.exe 4348 Server.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe Token: 33 856 Dllhost.exe Token: SeIncBasePriorityPrivilege 856 Dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exeDllhost.exedescription pid process target process PID 4160 wrote to memory of 856 4160 db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe Dllhost.exe PID 4160 wrote to memory of 856 4160 db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe Dllhost.exe PID 4160 wrote to memory of 856 4160 db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe Dllhost.exe PID 856 wrote to memory of 3368 856 Dllhost.exe schtasks.exe PID 856 wrote to memory of 3368 856 Dllhost.exe schtasks.exe PID 856 wrote to memory of 3368 856 Dllhost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe"C:\Users\Admin\AppData\Local\Temp\db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.logFilesize
408B
MD542157868488d3ef98c00e3fa12f064be
SHA1aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA256b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
SHA5128f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD571152f3b9a20b6bdf15451f7fefceeb5
SHA1f1bfb4bbf23866b97cee0fb39895f365377003e9
SHA256db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e
SHA5121efcb54168dd7abeefd5fd74147d86d8131ccb75c70b4c24673af88df4781577d31278ea8148ad061fc1177e5f9f71bdbc31e5528b7b5067ced19467bce36fb7
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD571152f3b9a20b6bdf15451f7fefceeb5
SHA1f1bfb4bbf23866b97cee0fb39895f365377003e9
SHA256db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e
SHA5121efcb54168dd7abeefd5fd74147d86d8131ccb75c70b4c24673af88df4781577d31278ea8148ad061fc1177e5f9f71bdbc31e5528b7b5067ced19467bce36fb7
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD571152f3b9a20b6bdf15451f7fefceeb5
SHA1f1bfb4bbf23866b97cee0fb39895f365377003e9
SHA256db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e
SHA5121efcb54168dd7abeefd5fd74147d86d8131ccb75c70b4c24673af88df4781577d31278ea8148ad061fc1177e5f9f71bdbc31e5528b7b5067ced19467bce36fb7
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD571152f3b9a20b6bdf15451f7fefceeb5
SHA1f1bfb4bbf23866b97cee0fb39895f365377003e9
SHA256db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e
SHA5121efcb54168dd7abeefd5fd74147d86d8131ccb75c70b4c24673af88df4781577d31278ea8148ad061fc1177e5f9f71bdbc31e5528b7b5067ced19467bce36fb7
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD571152f3b9a20b6bdf15451f7fefceeb5
SHA1f1bfb4bbf23866b97cee0fb39895f365377003e9
SHA256db7e41ad958ee52cb6257330e55b25f8e9314d89719c78b524e8b76025d2252e
SHA5121efcb54168dd7abeefd5fd74147d86d8131ccb75c70b4c24673af88df4781577d31278ea8148ad061fc1177e5f9f71bdbc31e5528b7b5067ced19467bce36fb7
-
memory/856-131-0x0000000000000000-mapping.dmp
-
memory/856-134-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB
-
memory/3368-135-0x0000000000000000-mapping.dmp
-
memory/4160-130-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB
-
memory/4348-138-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB
-
memory/4376-141-0x00000000752A0000-0x0000000075851000-memory.dmpFilesize
5.7MB