Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 14:37
Behavioral task
behavioral1
Sample
35748fa679aab5a3da229284f66ce004.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35748fa679aab5a3da229284f66ce004.exe
Resource
win10v2004-20220414-en
General
-
Target
35748fa679aab5a3da229284f66ce004.exe
-
Size
43KB
-
MD5
35748fa679aab5a3da229284f66ce004
-
SHA1
23ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
-
SHA256
faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
-
SHA512
c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.ngrok.io:19536
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 3 IoCs
Processes:
Dllhost.exeServer.exeServer.exepid process 952 Dllhost.exe 1136 Server.exe 848 Server.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Loads dropped DLL 1 IoCs
Processes:
35748fa679aab5a3da229284f66ce004.exepid process 316 35748fa679aab5a3da229284f66ce004.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Dllhost.exepid process 952 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe Token: 33 952 Dllhost.exe Token: SeIncBasePriorityPrivilege 952 Dllhost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
35748fa679aab5a3da229284f66ce004.exeDllhost.exetaskeng.exedescription pid process target process PID 316 wrote to memory of 952 316 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 316 wrote to memory of 952 316 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 316 wrote to memory of 952 316 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 316 wrote to memory of 952 316 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 952 wrote to memory of 2040 952 Dllhost.exe schtasks.exe PID 952 wrote to memory of 2040 952 Dllhost.exe schtasks.exe PID 952 wrote to memory of 2040 952 Dllhost.exe schtasks.exe PID 952 wrote to memory of 2040 952 Dllhost.exe schtasks.exe PID 780 wrote to memory of 1136 780 taskeng.exe Server.exe PID 780 wrote to memory of 1136 780 taskeng.exe Server.exe PID 780 wrote to memory of 1136 780 taskeng.exe Server.exe PID 780 wrote to memory of 1136 780 taskeng.exe Server.exe PID 780 wrote to memory of 848 780 taskeng.exe Server.exe PID 780 wrote to memory of 848 780 taskeng.exe Server.exe PID 780 wrote to memory of 848 780 taskeng.exe Server.exe PID 780 wrote to memory of 848 780 taskeng.exe Server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35748fa679aab5a3da229284f66ce004.exe"C:\Users\Admin\AppData\Local\Temp\35748fa679aab5a3da229284f66ce004.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {31EC9CDF-8049-4D8C-A954-5453E9792176} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
\Users\Admin\AppData\Local\Temp\Dllhost.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
memory/316-55-0x0000000076431000-0x0000000076433000-memory.dmpFilesize
8KB
-
memory/316-54-0x0000000000E60000-0x0000000000E72000-memory.dmpFilesize
72KB
-
memory/848-67-0x0000000000000000-mapping.dmp
-
memory/848-69-0x0000000000B50000-0x0000000000B62000-memory.dmpFilesize
72KB
-
memory/952-57-0x0000000000000000-mapping.dmp
-
memory/952-60-0x0000000000050000-0x0000000000062000-memory.dmpFilesize
72KB
-
memory/1136-66-0x0000000000940000-0x0000000000952000-memory.dmpFilesize
72KB
-
memory/1136-64-0x0000000000000000-mapping.dmp
-
memory/2040-62-0x0000000000000000-mapping.dmp