Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 14:37
Behavioral task
behavioral1
Sample
35748fa679aab5a3da229284f66ce004.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35748fa679aab5a3da229284f66ce004.exe
Resource
win10v2004-20220414-en
General
-
Target
35748fa679aab5a3da229284f66ce004.exe
-
Size
43KB
-
MD5
35748fa679aab5a3da229284f66ce004
-
SHA1
23ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
-
SHA256
faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
-
SHA512
c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.ngrok.io:19536
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE 3 IoCs
Processes:
Dllhost.exeServer.exeServer.exepid process 4688 Dllhost.exe 3752 Server.exe 4728 Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
35748fa679aab5a3da229284f66ce004.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 35748fa679aab5a3da229284f66ce004.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
35748fa679aab5a3da229284f66ce004.exeDllhost.exepid process 4948 35748fa679aab5a3da229284f66ce004.exe 4688 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe Token: 33 4688 Dllhost.exe Token: SeIncBasePriorityPrivilege 4688 Dllhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
35748fa679aab5a3da229284f66ce004.exeDllhost.exedescription pid process target process PID 4948 wrote to memory of 4688 4948 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 4948 wrote to memory of 4688 4948 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 4948 wrote to memory of 4688 4948 35748fa679aab5a3da229284f66ce004.exe Dllhost.exe PID 4688 wrote to memory of 3460 4688 Dllhost.exe schtasks.exe PID 4688 wrote to memory of 3460 4688 Dllhost.exe schtasks.exe PID 4688 wrote to memory of 3460 4688 Dllhost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35748fa679aab5a3da229284f66ce004.exe"C:\Users\Admin\AppData\Local\Temp\35748fa679aab5a3da229284f66ce004.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.logFilesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD535748fa679aab5a3da229284f66ce004
SHA123ba0a211dd963bf7c08d1d8cfdf4c4ab57c398b
SHA256faa6970d520931fbcf337e3f3aadfbf28bb4e7be36c789138d10154284ef446d
SHA512c407e777b1fbb3665f20e8e48ce99fca21d89369714370497bc3504c50ff4aa72330bfb47f3dd8774e328675d8f37b8667ff9cf6e5b696b43a57b3cd9ce25c5a
-
memory/3460-137-0x0000000000000000-mapping.dmp
-
memory/4688-139-0x0000000005500000-0x000000000550A000-memory.dmpFilesize
40KB
-
memory/4688-138-0x0000000005630000-0x0000000005696000-memory.dmpFilesize
408KB
-
memory/4688-134-0x0000000000000000-mapping.dmp
-
memory/4948-130-0x0000000000830000-0x0000000000842000-memory.dmpFilesize
72KB
-
memory/4948-133-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/4948-132-0x0000000005B20000-0x00000000060C4000-memory.dmpFilesize
5.6MB
-
memory/4948-131-0x0000000005290000-0x000000000532C000-memory.dmpFilesize
624KB