Analysis
-
max time kernel
171s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 09:24
Static task
static1
Behavioral task
behavioral1
Sample
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
Resource
win10v2004-20220414-en
General
-
Target
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
-
Size
852KB
-
MD5
176b5acb7e99a0f6b96e67008211a6ba
-
SHA1
3cc11249673f7d66ce36da881a461c12a435e421
-
SHA256
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3
-
SHA512
168744ff4454a49666092694bd2949d3bc5d50703d855077651fff3ba7be91e398d053a4fe797cdc74bfdfb52c8fa1e765bd4989ef46b47949610c5eb05ddf5a
Malware Config
Extracted
njrat
0.6.4
HacKed
shadowpro87.ddns.net:1177
9165950e91e4e361fa21d31cf1cfc39b
-
reg_key
9165950e91e4e361fa21d31cf1cfc39b
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
FB_4654.tmp.exeFB_475E.tmp.comconfig.exepid process 364 FB_4654.tmp.exe 316 FB_475E.tmp.com 320 config.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
Processes:
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exeFB_475E.tmp.compid process 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe 316 FB_475E.tmp.com -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
config.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\9165950e91e4e361fa21d31cf1cfc39b = "\"C:\\Users\\Admin\\AppData\\Roaming\\config.exe\" .." config.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9165950e91e4e361fa21d31cf1cfc39b = "\"C:\\Users\\Admin\\AppData\\Roaming\\config.exe\" .." config.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
config.exepid process 320 config.exe 320 config.exe 320 config.exe 320 config.exe 320 config.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
config.exedescription pid process Token: SeDebugPrivilege 320 config.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exeFB_475E.tmp.comconfig.exedescription pid process target process PID 1348 wrote to memory of 364 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_4654.tmp.exe PID 1348 wrote to memory of 364 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_4654.tmp.exe PID 1348 wrote to memory of 364 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_4654.tmp.exe PID 1348 wrote to memory of 364 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_4654.tmp.exe PID 1348 wrote to memory of 316 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_475E.tmp.com PID 1348 wrote to memory of 316 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_475E.tmp.com PID 1348 wrote to memory of 316 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_475E.tmp.com PID 1348 wrote to memory of 316 1348 3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe FB_475E.tmp.com PID 316 wrote to memory of 320 316 FB_475E.tmp.com config.exe PID 316 wrote to memory of 320 316 FB_475E.tmp.com config.exe PID 316 wrote to memory of 320 316 FB_475E.tmp.com config.exe PID 316 wrote to memory of 320 316 FB_475E.tmp.com config.exe PID 320 wrote to memory of 1072 320 config.exe netsh.exe PID 320 wrote to memory of 1072 320 config.exe netsh.exe PID 320 wrote to memory of 1072 320 config.exe netsh.exe PID 320 wrote to memory of 1072 320 config.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe"C:\Users\Admin\AppData\Local\Temp\3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FB_4654.tmp.exe"C:\Users\Admin\AppData\Local\Temp\FB_4654.tmp.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FB_475E.tmp.com"C:\Users\Admin\AppData\Local\Temp\FB_475E.tmp.com"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\config.exe"C:\Users\Admin\AppData\Roaming\config.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\config.exe" "config.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FB_4654.tmp.exeFilesize
383KB
MD5561674e508d910f7f3ad690e63c5a4ff
SHA17f74325e9927d35ae3115f25254d1027c5d6ada3
SHA256d5b0f4f52fff7353781c712b8991d9bea2ceb9cb4b669d9fed4b578e6219eefa
SHA5129d193c401e04c13f278420a15efc1339f22a6bdac13c6d1bb780b2f70a15308086d4d2a400b5f7d9aee4d77203572ac8103bd51d10e5031b3e456931ef40d45c
-
C:\Users\Admin\AppData\Local\Temp\FB_4654.tmp.exeFilesize
383KB
MD5561674e508d910f7f3ad690e63c5a4ff
SHA17f74325e9927d35ae3115f25254d1027c5d6ada3
SHA256d5b0f4f52fff7353781c712b8991d9bea2ceb9cb4b669d9fed4b578e6219eefa
SHA5129d193c401e04c13f278420a15efc1339f22a6bdac13c6d1bb780b2f70a15308086d4d2a400b5f7d9aee4d77203572ac8103bd51d10e5031b3e456931ef40d45c
-
C:\Users\Admin\AppData\Local\Temp\FB_475E.tmp.comFilesize
265KB
MD5bbb0eaa3d707e757e7e92de8968f9fa5
SHA1bade9eb744210496c4f53ddc44264d21f3c32732
SHA256098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2
SHA5129ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71
-
C:\Users\Admin\AppData\Local\Temp\FB_475E.tmp.comFilesize
265KB
MD5bbb0eaa3d707e757e7e92de8968f9fa5
SHA1bade9eb744210496c4f53ddc44264d21f3c32732
SHA256098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2
SHA5129ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71
-
C:\Users\Admin\AppData\Roaming\config.exeFilesize
265KB
MD5bbb0eaa3d707e757e7e92de8968f9fa5
SHA1bade9eb744210496c4f53ddc44264d21f3c32732
SHA256098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2
SHA5129ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71
-
C:\Users\Admin\AppData\Roaming\config.exeFilesize
265KB
MD5bbb0eaa3d707e757e7e92de8968f9fa5
SHA1bade9eb744210496c4f53ddc44264d21f3c32732
SHA256098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2
SHA5129ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71
-
\Users\Admin\AppData\Local\Temp\FB_4654.tmp.exeFilesize
383KB
MD5561674e508d910f7f3ad690e63c5a4ff
SHA17f74325e9927d35ae3115f25254d1027c5d6ada3
SHA256d5b0f4f52fff7353781c712b8991d9bea2ceb9cb4b669d9fed4b578e6219eefa
SHA5129d193c401e04c13f278420a15efc1339f22a6bdac13c6d1bb780b2f70a15308086d4d2a400b5f7d9aee4d77203572ac8103bd51d10e5031b3e456931ef40d45c
-
\Users\Admin\AppData\Local\Temp\FB_475E.tmp.comFilesize
265KB
MD5bbb0eaa3d707e757e7e92de8968f9fa5
SHA1bade9eb744210496c4f53ddc44264d21f3c32732
SHA256098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2
SHA5129ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71
-
\Users\Admin\AppData\Roaming\config.exeFilesize
265KB
MD5bbb0eaa3d707e757e7e92de8968f9fa5
SHA1bade9eb744210496c4f53ddc44264d21f3c32732
SHA256098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2
SHA5129ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71
-
memory/316-63-0x0000000000950000-0x000000000099A000-memory.dmpFilesize
296KB
-
memory/316-67-0x00000000001F0000-0x00000000001FE000-memory.dmpFilesize
56KB
-
memory/316-60-0x0000000000000000-mapping.dmp
-
memory/320-70-0x0000000000000000-mapping.dmp
-
memory/320-73-0x0000000001200000-0x000000000124A000-memory.dmpFilesize
296KB
-
memory/364-56-0x0000000000000000-mapping.dmp
-
memory/364-66-0x0000000004CC6000-0x0000000004CD7000-memory.dmpFilesize
68KB
-
memory/364-64-0x00000000000C0000-0x0000000000128000-memory.dmpFilesize
416KB
-
memory/1072-74-0x0000000000000000-mapping.dmp
-
memory/1348-54-0x0000000076531000-0x0000000076533000-memory.dmpFilesize
8KB