Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 17:57
Behavioral task
behavioral1
Sample
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe
Resource
win10v2004-20220414-en
General
-
Target
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe
-
Size
43KB
-
MD5
022546fb9a9b62958ddb0794c9f6b95a
-
SHA1
15888870cc340c297fc1858fa552c5f10ce630b7
-
SHA256
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587
-
SHA512
35bfab9d8bc054204cf8b9e30b7499e450c70163cb385230ef535f8ca39e83472919543cbedc84f998b18ca9be840037aa9371dc1b86f7b6ff7f6f8db801f7b4
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
nikits.ddns.net:1604
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Dllhost.exepid process 1288 Dllhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exeDllhost.exepid process 2068 3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe 1288 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe Token: 33 1288 Dllhost.exe Token: SeIncBasePriorityPrivilege 1288 Dllhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exedescription pid process target process PID 2068 wrote to memory of 1288 2068 3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe Dllhost.exe PID 2068 wrote to memory of 1288 2068 3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe Dllhost.exe PID 2068 wrote to memory of 1288 2068 3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe Dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe"C:\Users\Admin\AppData\Local\Temp\3e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD5022546fb9a9b62958ddb0794c9f6b95a
SHA115888870cc340c297fc1858fa552c5f10ce630b7
SHA2563e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587
SHA51235bfab9d8bc054204cf8b9e30b7499e450c70163cb385230ef535f8ca39e83472919543cbedc84f998b18ca9be840037aa9371dc1b86f7b6ff7f6f8db801f7b4
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD5022546fb9a9b62958ddb0794c9f6b95a
SHA115888870cc340c297fc1858fa552c5f10ce630b7
SHA2563e6b77bd648a953a7f602a7be5fa16d47a1bb3adda887c8760c6fe1afdb1a587
SHA51235bfab9d8bc054204cf8b9e30b7499e450c70163cb385230ef535f8ca39e83472919543cbedc84f998b18ca9be840037aa9371dc1b86f7b6ff7f6f8db801f7b4
-
memory/1288-134-0x0000000000000000-mapping.dmp
-
memory/1288-137-0x0000000004AE0000-0x0000000004AEA000-memory.dmpFilesize
40KB
-
memory/2068-130-0x00000000009E0000-0x00000000009F2000-memory.dmpFilesize
72KB
-
memory/2068-131-0x0000000005360000-0x00000000053FC000-memory.dmpFilesize
624KB
-
memory/2068-132-0x0000000005CD0000-0x0000000006274000-memory.dmpFilesize
5.6MB
-
memory/2068-133-0x00000000057C0000-0x0000000005852000-memory.dmpFilesize
584KB