Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 14:28
Behavioral task
behavioral1
Sample
3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe
Resource
win7-20220414-en
General
-
Target
3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe
-
Size
29KB
-
MD5
731f1c1692ed7f73b5909f20e3378215
-
SHA1
f4f81657313928cd8954f08ef0dac309e9f44403
-
SHA256
3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2
-
SHA512
dee7f07ce25702caed6c052ae26ae2879fb1e4978d2a6ab62cc6509c467524f1f7e1481c8efb86756b87b8993161233e4c2cd1b25a8821f326acce4b01b4a689
Malware Config
Extracted
njrat
0.6.4
HacKed
moussaoui.noip.me:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 1984 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exepid process 1044 3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Trojan.exepid process 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe 1984 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 1984 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exeTrojan.exedescription pid process target process PID 1044 wrote to memory of 1984 1044 3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe Trojan.exe PID 1044 wrote to memory of 1984 1044 3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe Trojan.exe PID 1044 wrote to memory of 1984 1044 3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe Trojan.exe PID 1044 wrote to memory of 1984 1044 3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe Trojan.exe PID 1984 wrote to memory of 1464 1984 Trojan.exe netsh.exe PID 1984 wrote to memory of 1464 1984 Trojan.exe netsh.exe PID 1984 wrote to memory of 1464 1984 Trojan.exe netsh.exe PID 1984 wrote to memory of 1464 1984 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe"C:\Users\Admin\AppData\Local\Temp\3dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5731f1c1692ed7f73b5909f20e3378215
SHA1f4f81657313928cd8954f08ef0dac309e9f44403
SHA2563dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2
SHA512dee7f07ce25702caed6c052ae26ae2879fb1e4978d2a6ab62cc6509c467524f1f7e1481c8efb86756b87b8993161233e4c2cd1b25a8821f326acce4b01b4a689
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5731f1c1692ed7f73b5909f20e3378215
SHA1f4f81657313928cd8954f08ef0dac309e9f44403
SHA2563dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2
SHA512dee7f07ce25702caed6c052ae26ae2879fb1e4978d2a6ab62cc6509c467524f1f7e1481c8efb86756b87b8993161233e4c2cd1b25a8821f326acce4b01b4a689
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5731f1c1692ed7f73b5909f20e3378215
SHA1f4f81657313928cd8954f08ef0dac309e9f44403
SHA2563dcb048cc422d65c5a04bd27459bfd027f6e736c43b60d923eca702c4a01cfd2
SHA512dee7f07ce25702caed6c052ae26ae2879fb1e4978d2a6ab62cc6509c467524f1f7e1481c8efb86756b87b8993161233e4c2cd1b25a8821f326acce4b01b4a689
-
memory/1044-54-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/1044-61-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1464-60-0x0000000000000000-mapping.dmp
-
memory/1984-56-0x0000000000000000-mapping.dmp
-
memory/1984-62-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB
-
memory/1984-64-0x00000000744D0000-0x0000000074A7B000-memory.dmpFilesize
5.7MB