Analysis
-
max time kernel
188s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 04:41
Behavioral task
behavioral1
Sample
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe
Resource
win10v2004-20220414-en
General
-
Target
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe
-
Size
43KB
-
MD5
2c7e2f0618c5e97da339818408f8f280
-
SHA1
5e6ea81e291b81bd7281e7c7a27812ab101af1e2
-
SHA256
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01
-
SHA512
50dedbf570f9b9933623eac8b2e762e082cb60c22a3c629fdada9daa5367cd825b4aaf74d8f1afa0ee6f7c4cfba71ac15204c2b1636de5cc7a36a85025cfcc5a
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
hack
213.159.212.162:8472
DriverStartup
-
reg_key
DriverStartup
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
wininit.exeServer.exeServer.exepid process 4480 wininit.exe 1196 Server.exe 4996 Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe -
Drops startup file 2 IoCs
Processes:
wininit.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ChromeUpdate.exe wininit.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ChromeUpdate.exe wininit.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wininit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverStartup = "\"C:\\Users\\Admin\\AppData\\Roaming\\wininit.exe\" .." wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DriverStartup = "\"C:\\Users\\Admin\\AppData\\Roaming\\wininit.exe\" .." wininit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exewininit.exeServer.exepid process 4924 04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe 4480 wininit.exe 1196 Server.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
wininit.exedescription pid process Token: SeDebugPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe Token: 33 4480 wininit.exe Token: SeIncBasePriorityPrivilege 4480 wininit.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exewininit.exedescription pid process target process PID 4924 wrote to memory of 4480 4924 04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe wininit.exe PID 4924 wrote to memory of 4480 4924 04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe wininit.exe PID 4924 wrote to memory of 4480 4924 04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe wininit.exe PID 4480 wrote to memory of 3600 4480 wininit.exe schtasks.exe PID 4480 wrote to memory of 3600 4480 wininit.exe schtasks.exe PID 4480 wrote to memory of 3600 4480 wininit.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe"C:\Users\Admin\AppData\Local\Temp\04ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wininit.exe"C:\Users\Admin\AppData\Roaming\wininit.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.logFilesize
408B
MD542157868488d3ef98c00e3fa12f064be
SHA1aad391be9ac3f6ce1ced49583690486a5f4186fb
SHA256b9520170e84597186ba5cc223b9c2773f70d0cda088950bae2182e3b2237995c
SHA5128f4a4bd63ceefc34158ea23f3a73dcc2848eeacdba8355d1251a96b4e0c18e2f3b0c4939be359f874f81fe4ee63283b8be43a70fe2dbaa2e64784333d10a2471
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD52c7e2f0618c5e97da339818408f8f280
SHA15e6ea81e291b81bd7281e7c7a27812ab101af1e2
SHA25604ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01
SHA51250dedbf570f9b9933623eac8b2e762e082cb60c22a3c629fdada9daa5367cd825b4aaf74d8f1afa0ee6f7c4cfba71ac15204c2b1636de5cc7a36a85025cfcc5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD52c7e2f0618c5e97da339818408f8f280
SHA15e6ea81e291b81bd7281e7c7a27812ab101af1e2
SHA25604ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01
SHA51250dedbf570f9b9933623eac8b2e762e082cb60c22a3c629fdada9daa5367cd825b4aaf74d8f1afa0ee6f7c4cfba71ac15204c2b1636de5cc7a36a85025cfcc5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD52c7e2f0618c5e97da339818408f8f280
SHA15e6ea81e291b81bd7281e7c7a27812ab101af1e2
SHA25604ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01
SHA51250dedbf570f9b9933623eac8b2e762e082cb60c22a3c629fdada9daa5367cd825b4aaf74d8f1afa0ee6f7c4cfba71ac15204c2b1636de5cc7a36a85025cfcc5a
-
C:\Users\Admin\AppData\Roaming\wininit.exeFilesize
43KB
MD52c7e2f0618c5e97da339818408f8f280
SHA15e6ea81e291b81bd7281e7c7a27812ab101af1e2
SHA25604ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01
SHA51250dedbf570f9b9933623eac8b2e762e082cb60c22a3c629fdada9daa5367cd825b4aaf74d8f1afa0ee6f7c4cfba71ac15204c2b1636de5cc7a36a85025cfcc5a
-
C:\Users\Admin\AppData\Roaming\wininit.exeFilesize
43KB
MD52c7e2f0618c5e97da339818408f8f280
SHA15e6ea81e291b81bd7281e7c7a27812ab101af1e2
SHA25604ebda8dad22a5e9cfafc51dcccba313a2b8d11743da52bb114c1bfc165a0c01
SHA51250dedbf570f9b9933623eac8b2e762e082cb60c22a3c629fdada9daa5367cd825b4aaf74d8f1afa0ee6f7c4cfba71ac15204c2b1636de5cc7a36a85025cfcc5a
-
memory/1196-138-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB
-
memory/3600-135-0x0000000000000000-mapping.dmp
-
memory/4480-131-0x0000000000000000-mapping.dmp
-
memory/4480-134-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB
-
memory/4924-130-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB
-
memory/4996-141-0x0000000074BC0000-0x0000000075171000-memory.dmpFilesize
5.7MB