Analysis
-
max time kernel
169s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 22:10
Static task
static1
Behavioral task
behavioral1
Sample
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
Resource
win10v2004-20220812-en
General
-
Target
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe
-
Size
472KB
-
MD5
73490eea715262aa6dbc8a0b777adf30
-
SHA1
013d11b58619e035957fe8ee8ccfe35904f5011f
-
SHA256
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98
-
SHA512
069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b
-
SSDEEP
12288:atD+nyKFY1iHPeugsRYgX+wCk7aszyrZ:0ynymY1iHlVOnZ
Malware Config
Extracted
njrat
0.7d
HacKed
blackman00000.no-ip.biz:1995
c25a09183d9a8afb0f4533b14dd064b5
-
reg_key
c25a09183d9a8afb0f4533b14dd064b5
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Explorer.exeExplorer.exepid process 4732 Explorer.exe 3116 Explorer.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe -
Drops startup file 2 IoCs
Processes:
Explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c25a09183d9a8afb0f4533b14dd064b5.exe Explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c25a09183d9a8afb0f4533b14dd064b5.exe Explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c25a09183d9a8afb0f4533b14dd064b5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe\" .." Explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\c25a09183d9a8afb0f4533b14dd064b5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe\" .." Explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exedescription pid process target process PID 2248 set thread context of 4636 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe PID 4732 set thread context of 3116 4732 Explorer.exe Explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exepid process 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe 4732 Explorer.exe 4732 Explorer.exe 4732 Explorer.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exeExplorer.exedescription pid process Token: SeDebugPrivilege 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe Token: SeDebugPrivilege 4732 Explorer.exe Token: SeDebugPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe Token: 33 3116 Explorer.exe Token: SeIncBasePriorityPrivilege 3116 Explorer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exed673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeExplorer.exeExplorer.exedescription pid process target process PID 2248 wrote to memory of 4636 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe PID 2248 wrote to memory of 4636 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe PID 2248 wrote to memory of 4636 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe PID 2248 wrote to memory of 4636 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe PID 2248 wrote to memory of 4636 2248 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe PID 4636 wrote to memory of 4732 4636 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe Explorer.exe PID 4636 wrote to memory of 4732 4636 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe Explorer.exe PID 4636 wrote to memory of 4732 4636 d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe Explorer.exe PID 4732 wrote to memory of 3116 4732 Explorer.exe Explorer.exe PID 4732 wrote to memory of 3116 4732 Explorer.exe Explorer.exe PID 4732 wrote to memory of 3116 4732 Explorer.exe Explorer.exe PID 4732 wrote to memory of 3116 4732 Explorer.exe Explorer.exe PID 4732 wrote to memory of 3116 4732 Explorer.exe Explorer.exe PID 3116 wrote to memory of 4784 3116 Explorer.exe netsh.exe PID 3116 wrote to memory of 4784 3116 Explorer.exe netsh.exe PID 3116 wrote to memory of 4784 3116 Explorer.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe"C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exeC:\Users\Admin\AppData\Local\Temp\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Explorer.exe"C:\Users\Admin\AppData\Roaming\Explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Explorer.exeC:\Users\Admin\AppData\Roaming\Explorer.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Explorer.exe" "Explorer.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98.exe.logFilesize
587B
MD5ec1d4f8482eabd1b31097b6b83fd2d06
SHA1b00d2dca5c255ccc34a50b5a5ed894afabf13ba6
SHA256f7c7efd546b3232d33f49656fcf5a5d883400fe2fa27b40c60db695c4a16c671
SHA512a21cd5912f1cee6663ad16b687a0ff1383fc921be5edc8ebf30b7d3b3cfcbb63a356e0b600eba05e62d900887b3e3fb0fa44eaf8453af2ce35319476c4e5e992
-
C:\Users\Admin\AppData\Roaming\Explorer.exeFilesize
472KB
MD573490eea715262aa6dbc8a0b777adf30
SHA1013d11b58619e035957fe8ee8ccfe35904f5011f
SHA256d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98
SHA512069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b
-
C:\Users\Admin\AppData\Roaming\Explorer.exeFilesize
472KB
MD573490eea715262aa6dbc8a0b777adf30
SHA1013d11b58619e035957fe8ee8ccfe35904f5011f
SHA256d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98
SHA512069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b
-
C:\Users\Admin\AppData\Roaming\Explorer.exeFilesize
472KB
MD573490eea715262aa6dbc8a0b777adf30
SHA1013d11b58619e035957fe8ee8ccfe35904f5011f
SHA256d673fe5c5691add5847337394303204b7e9e7a46609490ba31a924ab12d71c98
SHA512069bd28f7180cde99f88ca6561ed56c04f4721f22f57925d9701176406d45d2a72baa66fab040888fc9b430624d2cdf5067e860d393d42759077e587dc84398b
-
memory/2248-137-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/2248-133-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/3116-144-0x0000000000000000-mapping.dmp
-
memory/3116-150-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/3116-147-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4636-135-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4636-142-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4636-134-0x0000000000000000-mapping.dmp
-
memory/4636-136-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4732-143-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4732-148-0x0000000075100000-0x00000000756B1000-memory.dmpFilesize
5.7MB
-
memory/4732-138-0x0000000000000000-mapping.dmp
-
memory/4784-149-0x0000000000000000-mapping.dmp