Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 07:09
Static task
static1
Behavioral task
behavioral1
Sample
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe
Resource
win10v2004-20220414-en
General
-
Target
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe
-
Size
151KB
-
MD5
de60ed7b81a44cc3f849f7d9cc1bc012
-
SHA1
116f0f25f3bccfaf3aeedd410c82aca5ff707a51
-
SHA256
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167
-
SHA512
66ef7f125012a489e70e83e99d99a688df2b7c698447264fa8aca4b1e6b3b3bc35f62d09e4b48e75e7e27511f29db491cc7a0c44d5067a517a8878f5567de1fe
Malware Config
Extracted
njrat
0.7d
HacKed
194.5.98.252:4040
33f7a57b89a02bde4760bf8635bffaec
-
reg_key
33f7a57b89a02bde4760bf8635bffaec
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 4904 AddInProcess32.exe -
Modifies Windows Firewall 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AddInProcess32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\33f7a57b89a02bde4760bf8635bffaec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AddInProcess32.exe\" .." AddInProcess32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\33f7a57b89a02bde4760bf8635bffaec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\AddInProcess32.exe\" .." AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exedescription pid process target process PID 4508 set thread context of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exepid process 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe Token: SeDebugPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe Token: 33 4904 AddInProcess32.exe Token: SeIncBasePriorityPrivilege 4904 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exeAddInProcess32.exedescription pid process target process PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4508 wrote to memory of 4904 4508 678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe AddInProcess32.exe PID 4904 wrote to memory of 2220 4904 AddInProcess32.exe netsh.exe PID 4904 wrote to memory of 2220 4904 AddInProcess32.exe netsh.exe PID 4904 wrote to memory of 2220 4904 AddInProcess32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe"C:\Users\Admin\AppData\Local\Temp\678c6d8585a6f5b73f1fb953852d72b18af35da4566248098ff1f13384977167.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe" "AddInProcess32.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
memory/2220-138-0x0000000000000000-mapping.dmp
-
memory/4508-130-0x0000000000A60000-0x0000000000A8C000-memory.dmpFilesize
176KB
-
memory/4508-131-0x00000000060F0000-0x0000000006694000-memory.dmpFilesize
5.6MB
-
memory/4508-132-0x0000000005C20000-0x0000000005CB2000-memory.dmpFilesize
584KB
-
memory/4904-133-0x0000000000000000-mapping.dmp
-
memory/4904-134-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4904-137-0x0000000004CF0000-0x0000000004D8C000-memory.dmpFilesize
624KB
-
memory/4904-139-0x0000000004EA0000-0x0000000004EAA000-memory.dmpFilesize
40KB