Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-09-2022 16:53
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe
Resource
win10v2004-20220812-en
General
-
Target
HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe
-
Size
23KB
-
MD5
3a698ce6d6a5431236be52b04b49a054
-
SHA1
cdd747af7b5e2e77a8a3e5c43147f7c4a4cf7179
-
SHA256
0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74
-
SHA512
8d0a2bd1b2f7b40d5b47be60fb014fd7cf9a1f6bf0e8dbcb970c61d8568365005d5ac1620c9035441d5c153a43eb0d5c69a128a5d4b918757fe89b6c080b4b7b
-
SSDEEP
384:BHsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZzaqm:Bcf65K2Yf1jKRpcnub
Malware Config
Extracted
njrat
0.7d
HacKed
109.0.221.45:7006
4b7f5fbef052312fadb4d8fe15ed0ebe
-
reg_key
4b7f5fbef052312fadb4d8fe15ed0ebe
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 1952 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4b7f5fbef052312fadb4d8fe15ed0ebe.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4b7f5fbef052312fadb4d8fe15ed0ebe.exe server.exe -
Loads dropped DLL 1 IoCs
Processes:
HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exepid process 1512 HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\4b7f5fbef052312fadb4d8fe15ed0ebe = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4b7f5fbef052312fadb4d8fe15ed0ebe = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe Token: 33 1952 server.exe Token: SeIncBasePriorityPrivilege 1952 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exeserver.exedescription pid process target process PID 1512 wrote to memory of 1952 1512 HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe server.exe PID 1512 wrote to memory of 1952 1512 HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe server.exe PID 1512 wrote to memory of 1952 1512 HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe server.exe PID 1512 wrote to memory of 1952 1512 HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe server.exe PID 1952 wrote to memory of 1004 1952 server.exe netsh.exe PID 1952 wrote to memory of 1004 1952 server.exe netsh.exe PID 1952 wrote to memory of 1004 1952 server.exe netsh.exe PID 1952 wrote to memory of 1004 1952 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-0604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
23KB
MD53a698ce6d6a5431236be52b04b49a054
SHA1cdd747af7b5e2e77a8a3e5c43147f7c4a4cf7179
SHA2560604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74
SHA5128d0a2bd1b2f7b40d5b47be60fb014fd7cf9a1f6bf0e8dbcb970c61d8568365005d5ac1620c9035441d5c153a43eb0d5c69a128a5d4b918757fe89b6c080b4b7b
-
C:\Users\Admin\AppData\Roaming\server.exeFilesize
23KB
MD53a698ce6d6a5431236be52b04b49a054
SHA1cdd747af7b5e2e77a8a3e5c43147f7c4a4cf7179
SHA2560604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74
SHA5128d0a2bd1b2f7b40d5b47be60fb014fd7cf9a1f6bf0e8dbcb970c61d8568365005d5ac1620c9035441d5c153a43eb0d5c69a128a5d4b918757fe89b6c080b4b7b
-
\Users\Admin\AppData\Roaming\server.exeFilesize
23KB
MD53a698ce6d6a5431236be52b04b49a054
SHA1cdd747af7b5e2e77a8a3e5c43147f7c4a4cf7179
SHA2560604c39eba575b6dde644df71e79c9f09bad8a4f3229a4d16f50ac5362387d74
SHA5128d0a2bd1b2f7b40d5b47be60fb014fd7cf9a1f6bf0e8dbcb970c61d8568365005d5ac1620c9035441d5c153a43eb0d5c69a128a5d4b918757fe89b6c080b4b7b
-
memory/1004-63-0x0000000000000000-mapping.dmp
-
memory/1512-54-0x00000000756A1000-0x00000000756A3000-memory.dmpFilesize
8KB
-
memory/1512-55-0x00000000748C0000-0x0000000074E6B000-memory.dmpFilesize
5.7MB
-
memory/1512-61-0x00000000748C0000-0x0000000074E6B000-memory.dmpFilesize
5.7MB
-
memory/1952-57-0x0000000000000000-mapping.dmp
-
memory/1952-62-0x00000000748C0000-0x0000000074E6B000-memory.dmpFilesize
5.7MB
-
memory/1952-65-0x00000000748C0000-0x0000000074E6B000-memory.dmpFilesize
5.7MB