Analysis
-
max time kernel
155s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 15:09
Behavioral task
behavioral1
Sample
a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe
Resource
win10v2004-20220721-en
General
-
Target
a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe
-
Size
29KB
-
MD5
f106bafcdab0eb37a2fc44211c364481
-
SHA1
5232f148bf6cf0b719c039f59a2096d1d7f8efa8
-
SHA256
a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf
-
SHA512
4cf1439c110d8ae3abafcf30864ffdb101a5dbb5172c8e2b2f6cf6335004d17cdf49e9117d895731db04f2dc079efb02dbc0d203507b2ebe1dfe84ac895f0971
Malware Config
Extracted
njrat
0.6.4
HacKed
emad1987.myq-see.com:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 1928 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exepid process 1548 a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
Trojan.exepid process 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe 1928 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 1928 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exeTrojan.exedescription pid process target process PID 1548 wrote to memory of 1928 1548 a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe Trojan.exe PID 1548 wrote to memory of 1928 1548 a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe Trojan.exe PID 1548 wrote to memory of 1928 1548 a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe Trojan.exe PID 1548 wrote to memory of 1928 1548 a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe Trojan.exe PID 1928 wrote to memory of 1532 1928 Trojan.exe netsh.exe PID 1928 wrote to memory of 1532 1928 Trojan.exe netsh.exe PID 1928 wrote to memory of 1532 1928 Trojan.exe netsh.exe PID 1928 wrote to memory of 1532 1928 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe"C:\Users\Admin\AppData\Local\Temp\a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5f106bafcdab0eb37a2fc44211c364481
SHA15232f148bf6cf0b719c039f59a2096d1d7f8efa8
SHA256a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf
SHA5124cf1439c110d8ae3abafcf30864ffdb101a5dbb5172c8e2b2f6cf6335004d17cdf49e9117d895731db04f2dc079efb02dbc0d203507b2ebe1dfe84ac895f0971
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5f106bafcdab0eb37a2fc44211c364481
SHA15232f148bf6cf0b719c039f59a2096d1d7f8efa8
SHA256a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf
SHA5124cf1439c110d8ae3abafcf30864ffdb101a5dbb5172c8e2b2f6cf6335004d17cdf49e9117d895731db04f2dc079efb02dbc0d203507b2ebe1dfe84ac895f0971
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5f106bafcdab0eb37a2fc44211c364481
SHA15232f148bf6cf0b719c039f59a2096d1d7f8efa8
SHA256a34c9020a14d78a10b28a1784149ba7826895858cb1c9d636d56839dabb07ecf
SHA5124cf1439c110d8ae3abafcf30864ffdb101a5dbb5172c8e2b2f6cf6335004d17cdf49e9117d895731db04f2dc079efb02dbc0d203507b2ebe1dfe84ac895f0971
-
memory/1532-61-0x0000000000000000-mapping.dmp
-
memory/1548-54-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/1548-55-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB
-
memory/1548-62-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB
-
memory/1928-57-0x0000000000000000-mapping.dmp
-
memory/1928-64-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB
-
memory/1928-65-0x0000000074E30000-0x00000000753DB000-memory.dmpFilesize
5.7MB