Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 12:56
Behavioral task
behavioral1
Sample
bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe
Resource
win7-20220414-en
General
-
Target
bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe
-
Size
29KB
-
MD5
0b87ba9858876702d052c84f27a2675e
-
SHA1
a7ce50effb4f59effc0d08d643170bae2456f954
-
SHA256
bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6
-
SHA512
55bd5778a0d38f1085ba0ac49b7a3d608876974fd949ed5c452b0ce144a06c65f8fe066743369cf5ff174231bda036ce77cea175e6aee34b7420f13f09f58b36
Malware Config
Extracted
njrat
0.6.4
HacKed
dadijinn.ddns.net:1177
d5a38e9b5f206c41f8851bf04a251d26
-
reg_key
d5a38e9b5f206c41f8851bf04a251d26
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 1672 chrome.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exepid process 1900 bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exepid process 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe 1672 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 1672 chrome.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exechrome.exedescription pid process target process PID 1900 wrote to memory of 1672 1900 bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe chrome.exe PID 1900 wrote to memory of 1672 1900 bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe chrome.exe PID 1900 wrote to memory of 1672 1900 bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe chrome.exe PID 1900 wrote to memory of 1672 1900 bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe chrome.exe PID 1672 wrote to memory of 840 1672 chrome.exe netsh.exe PID 1672 wrote to memory of 840 1672 chrome.exe netsh.exe PID 1672 wrote to memory of 840 1672 chrome.exe netsh.exe PID 1672 wrote to memory of 840 1672 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe"C:\Users\Admin\AppData\Local\Temp\bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD50b87ba9858876702d052c84f27a2675e
SHA1a7ce50effb4f59effc0d08d643170bae2456f954
SHA256bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6
SHA51255bd5778a0d38f1085ba0ac49b7a3d608876974fd949ed5c452b0ce144a06c65f8fe066743369cf5ff174231bda036ce77cea175e6aee34b7420f13f09f58b36
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD50b87ba9858876702d052c84f27a2675e
SHA1a7ce50effb4f59effc0d08d643170bae2456f954
SHA256bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6
SHA51255bd5778a0d38f1085ba0ac49b7a3d608876974fd949ed5c452b0ce144a06c65f8fe066743369cf5ff174231bda036ce77cea175e6aee34b7420f13f09f58b36
-
\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD50b87ba9858876702d052c84f27a2675e
SHA1a7ce50effb4f59effc0d08d643170bae2456f954
SHA256bde52e15a948a302b45b683d85bdaa0ec82688decf8f9d00847b616a75fa5cd6
SHA51255bd5778a0d38f1085ba0ac49b7a3d608876974fd949ed5c452b0ce144a06c65f8fe066743369cf5ff174231bda036ce77cea175e6aee34b7420f13f09f58b36
-
memory/840-61-0x0000000000000000-mapping.dmp
-
memory/1672-57-0x0000000000000000-mapping.dmp
-
memory/1672-63-0x0000000074B90000-0x000000007513B000-memory.dmpFilesize
5.7MB
-
memory/1900-54-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/1900-55-0x0000000074B90000-0x000000007513B000-memory.dmpFilesize
5.7MB