Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 17:58
Behavioral task
behavioral1
Sample
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe
Resource
win10v2004-20220414-en
General
-
Target
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe
-
Size
43KB
-
MD5
358ae564587620cc34b0a18ac5519f6c
-
SHA1
39885cfae334c24e282be860c1a5653bd0215199
-
SHA256
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
-
SHA512
48754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
123456789gg.ddns.net:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exeServer.exeServer.exepid process 4196 svchost.exe 4344 Server.exe 4480 Server.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exesvchost.exeServer.exepid process 4828 a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe 4196 svchost.exe 4344 Server.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe Token: 33 4196 svchost.exe Token: SeIncBasePriorityPrivilege 4196 svchost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exesvchost.exedescription pid process target process PID 4828 wrote to memory of 4196 4828 a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe svchost.exe PID 4828 wrote to memory of 4196 4828 a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe svchost.exe PID 4828 wrote to memory of 4196 4828 a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe svchost.exe PID 4196 wrote to memory of 1476 4196 svchost.exe schtasks.exe PID 4196 wrote to memory of 1476 4196 svchost.exe schtasks.exe PID 4196 wrote to memory of 1476 4196 svchost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe"C:\Users\Admin\AppData\Local\Temp\a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Server.exe.logFilesize
408B
MD5661cab77d3b907e8057f2e689e995af3
SHA15d1a0ee9c5ee7a7a90d56d00c10dc0e679bee01c
SHA2568f27f95ad7c09f2e05d7960e78ef8cd935c1262e9657883a75d70dcb877592d2
SHA5122523b316bd79fed0e9b3d73f46959f3dfe270cf950f34bd9d49fe4113a2ae46d0cd00224d848bc40c0d8c55449e2dccc4b4278ba4809c0ca9ede1ac75673fc67
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5358ae564587620cc34b0a18ac5519f6c
SHA139885cfae334c24e282be860c1a5653bd0215199
SHA256a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
SHA51248754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5358ae564587620cc34b0a18ac5519f6c
SHA139885cfae334c24e282be860c1a5653bd0215199
SHA256a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
SHA51248754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD5358ae564587620cc34b0a18ac5519f6c
SHA139885cfae334c24e282be860c1a5653bd0215199
SHA256a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
SHA51248754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
43KB
MD5358ae564587620cc34b0a18ac5519f6c
SHA139885cfae334c24e282be860c1a5653bd0215199
SHA256a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
SHA51248754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
43KB
MD5358ae564587620cc34b0a18ac5519f6c
SHA139885cfae334c24e282be860c1a5653bd0215199
SHA256a208c909320dd7c4712f1a1e668ca886860a97534a946ac20f45b0c412df342e
SHA51248754ba03d7c20eda29469e7269d24706ba1c43a30b24c196be2b375bed2fa48f46ccbc6b31a339e057646b75847100baf81fc72138629f49e92cbb030d2bcc0
-
memory/1476-135-0x0000000000000000-mapping.dmp
-
memory/4196-131-0x0000000000000000-mapping.dmp
-
memory/4196-134-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/4344-138-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/4480-141-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/4828-130-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB