Analysis
-
max time kernel
161s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 18:42
Behavioral task
behavioral1
Sample
da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe
Resource
win7-20220414-en
General
-
Target
da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe
-
Size
43KB
-
MD5
2cbedbd088a2d679fa54e49f1ca04f07
-
SHA1
933e21bf76b0d6c43e670c58ce32a7785696bb1a
-
SHA256
da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed
-
SHA512
25144360822c308cc22b8f4f722fed662390aac5d0460452dcdd01445e996fe3982514cf976ae3ef129795d8fa565fcb992acd438eafa3fa20b975278b99ae9b
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
gazik500,ddns.net:9292
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Eroxt.exepid process 4872 Eroxt.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exeEroxt.exepid process 4328 da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe 4872 Eroxt.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
Eroxt.exedescription pid process Token: SeDebugPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe Token: 33 4872 Eroxt.exe Token: SeIncBasePriorityPrivilege 4872 Eroxt.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exedescription pid process target process PID 4328 wrote to memory of 4872 4328 da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe Eroxt.exe PID 4328 wrote to memory of 4872 4328 da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe Eroxt.exe PID 4328 wrote to memory of 4872 4328 da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe Eroxt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe"C:\Users\Admin\AppData\Local\Temp\da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Eroxt.exe"C:\Users\Admin\AppData\Local\Temp\Eroxt.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Eroxt.exeFilesize
43KB
MD52cbedbd088a2d679fa54e49f1ca04f07
SHA1933e21bf76b0d6c43e670c58ce32a7785696bb1a
SHA256da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed
SHA51225144360822c308cc22b8f4f722fed662390aac5d0460452dcdd01445e996fe3982514cf976ae3ef129795d8fa565fcb992acd438eafa3fa20b975278b99ae9b
-
C:\Users\Admin\AppData\Local\Temp\Eroxt.exeFilesize
43KB
MD52cbedbd088a2d679fa54e49f1ca04f07
SHA1933e21bf76b0d6c43e670c58ce32a7785696bb1a
SHA256da1e7c7c27b4846da4557a0b766285dffcf4be704327afad1eaa2fe75b42e5ed
SHA51225144360822c308cc22b8f4f722fed662390aac5d0460452dcdd01445e996fe3982514cf976ae3ef129795d8fa565fcb992acd438eafa3fa20b975278b99ae9b
-
memory/4328-130-0x0000000000030000-0x0000000000042000-memory.dmpFilesize
72KB
-
memory/4328-131-0x00000000049F0000-0x0000000004A8C000-memory.dmpFilesize
624KB
-
memory/4328-132-0x0000000005340000-0x00000000058E4000-memory.dmpFilesize
5.6MB
-
memory/4328-133-0x0000000004E30000-0x0000000004EC2000-memory.dmpFilesize
584KB
-
memory/4872-134-0x0000000000000000-mapping.dmp
-
memory/4872-137-0x0000000005480000-0x000000000548A000-memory.dmpFilesize
40KB