Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
25-06-2022 10:35
Static task
static1
Behavioral task
behavioral1
Sample
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe
-
Size
919KB
-
MD5
396b59946e1211f68e52677de66ccbc6
-
SHA1
fd051f956b1a6764945464666395b077f2ea5462
-
SHA256
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969
-
SHA512
65030131559f23b61503da19e5725527847247d349022441f07dfdb47a58085484f2825624a6a9feb8bbfe0048a46bd37afe73cd409262bcbbfdd9df538a4712
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
fourth#4
C2
soft98.linkpc.net:5550
Mutex
10e93180d6481ad63a77c2b255d40864
Attributes
-
reg_key
10e93180d6481ad63a77c2b255d40864
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 1 IoCs
Processes:
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Host Process for Windows Services.url 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exedescription pid process target process PID 1192 set thread context of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe Token: 33 1868 RegAsm.exe Token: SeIncBasePriorityPrivilege 1868 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exepid process 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exepid process 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exeRegAsm.exedescription pid process target process PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1192 wrote to memory of 1868 1192 8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe RegAsm.exe PID 1868 wrote to memory of 940 1868 RegAsm.exe netsh.exe PID 1868 wrote to memory of 940 1868 RegAsm.exe netsh.exe PID 1868 wrote to memory of 940 1868 RegAsm.exe netsh.exe PID 1868 wrote to memory of 940 1868 RegAsm.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe"C:\Users\Admin\AppData\Local\Temp\8097383fc8d67a40c647b8e892fc7a28a68dc82fa16f51303ae99a5e82c61969.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/940-67-0x0000000000000000-mapping.dmp
-
memory/1192-54-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/1868-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1868-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1868-62-0x000000000040747E-mapping.dmp
-
memory/1868-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1868-64-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1868-66-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB
-
memory/1868-69-0x0000000074950000-0x0000000074EFB000-memory.dmpFilesize
5.7MB