Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 07:09
Static task
static1
Behavioral task
behavioral1
Sample
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe
Resource
win10v2004-20220414-en
General
-
Target
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe
-
Size
151KB
-
MD5
de60ed7b81a44cc3f849f7d9cc1bc012
-
SHA1
116f0f25f3bccfaf3aeedd410c82aca5ff707a51
-
SHA256
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167
-
SHA512
66ef7f125012a489e70e83e99d99a688df2b7c698447264fa8aca4b1e6b3b3bc35f62d09e4b48e75e7e27511f29db491cc7a0c44d5067a517a8878f5567de1fe
Malware Config
Extracted
njrat
0.7d
HacKed
194.5.98.252:4040
33f7a57b89a02bde4760bf8635bffaec
-
reg_key
33f7a57b89a02bde4760bf8635bffaec
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 1608 AddInProcess32.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exepid process 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AddInProcess32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\33f7a57b89a02bde4760bf8635bffaec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AddInProcess32.exe\" .." AddInProcess32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\33f7a57b89a02bde4760bf8635bffaec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AddInProcess32.exe\" .." AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exedescription pid process target process PID 1996 set thread context of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exepid process 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe Token: SeDebugPrivilege 1608 AddInProcess32.exe Token: 33 1608 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 1608 AddInProcess32.exe Token: 33 1608 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 1608 AddInProcess32.exe Token: 33 1608 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 1608 AddInProcess32.exe Token: 33 1608 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 1608 AddInProcess32.exe Token: 33 1608 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 1608 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exeAddInProcess32.exedescription pid process target process PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1996 wrote to memory of 1608 1996 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 1608 wrote to memory of 1752 1608 AddInProcess32.exe netsh.exe PID 1608 wrote to memory of 1752 1608 AddInProcess32.exe netsh.exe PID 1608 wrote to memory of 1752 1608 AddInProcess32.exe netsh.exe PID 1608 wrote to memory of 1752 1608 AddInProcess32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe"C:\Users\Admin\AppData\Local\Temp\678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe" "AddInProcess32.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
41KB
MD56a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
memory/1608-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1608-59-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1608-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1608-62-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1608-65-0x000000000040747E-mapping.dmp
-
memory/1608-64-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1608-68-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1608-70-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1752-72-0x0000000000000000-mapping.dmp
-
memory/1996-57-0x0000000000650000-0x000000000065A000-memory.dmpFilesize
40KB
-
memory/1996-54-0x0000000001360000-0x000000000138C000-memory.dmpFilesize
176KB
-
memory/1996-56-0x0000000000330000-0x000000000034C000-memory.dmpFilesize
112KB
-
memory/1996-55-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB