Analysis
-
max time kernel
41s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 23:04
Static task
static1
Behavioral task
behavioral1
Sample
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe
Resource
win10v2004-20220812-en
General
-
Target
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe
-
Size
207KB
-
MD5
03f30bb108c14dd61e8cc7283ff03540
-
SHA1
f8de8c631e4c0bce2c0fb172e073d04cafbcc977
-
SHA256
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
-
SHA512
10fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
SSDEEP
3072:opc0A07hw14W+9u08t4uuQU8gd8RM9lOOQCtWnYBV7MnidGiy6Vy3BuOyFmrsds:Ip7hxhySuuQUwkQCtWk7MgQkQ5yFd
Malware Config
Extracted
njrat
0.7d
HacKed
biggsmall.no-ip.biz:5552
27f240735122562cdace87e6f4dc2e8b
-
reg_key
27f240735122562cdace87e6f4dc2e8b
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
taskeng.exepid process 1536 taskeng.exe -
Loads dropped DLL 1 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exepid process 848 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exedescription pid process target process PID 1692 set thread context of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exepid process 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 1536 taskeng.exe 1536 taskeng.exe 1536 taskeng.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exedescription pid process Token: SeDebugPrivilege 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe Token: SeDebugPrivilege 1536 taskeng.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exetaskeng.exedescription pid process target process PID 1692 wrote to memory of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 1692 wrote to memory of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 1692 wrote to memory of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 1692 wrote to memory of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 1692 wrote to memory of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 1692 wrote to memory of 848 1692 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe PID 848 wrote to memory of 1536 848 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 848 wrote to memory of 1536 848 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 848 wrote to memory of 1536 848 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 848 wrote to memory of 1536 848 0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe taskeng.exe PID 1536 wrote to memory of 1496 1536 taskeng.exe taskeng.exe PID 1536 wrote to memory of 1496 1536 taskeng.exe taskeng.exe PID 1536 wrote to memory of 1496 1536 taskeng.exe taskeng.exe PID 1536 wrote to memory of 1496 1536 taskeng.exe taskeng.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe"C:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exeC:\Users\Admin\AppData\Local\Temp\0e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskeng.exe"C:\Users\Admin\AppData\Roaming\taskeng.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\taskeng.exeC:\Users\Admin\AppData\Roaming\taskeng.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\taskeng.exeFilesize
207KB
MD503f30bb108c14dd61e8cc7283ff03540
SHA1f8de8c631e4c0bce2c0fb172e073d04cafbcc977
SHA2560e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
SHA51210fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
C:\Users\Admin\AppData\Roaming\taskeng.exeFilesize
207KB
MD503f30bb108c14dd61e8cc7283ff03540
SHA1f8de8c631e4c0bce2c0fb172e073d04cafbcc977
SHA2560e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
SHA51210fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
\Users\Admin\AppData\Roaming\taskeng.exeFilesize
207KB
MD503f30bb108c14dd61e8cc7283ff03540
SHA1f8de8c631e4c0bce2c0fb172e073d04cafbcc977
SHA2560e94a726b6cfe94bd8de2ef6f8ef70f543ae062c02ce62179a968470ce183e8b
SHA51210fea7e48e877055d1abb498f3dfc22dd110a1ebab832b05e5538fcc47c3dcf8bc25516d9ac251ef33c370e019506d9d8631fc6280d388e62214165d16f90602
-
memory/848-59-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/848-72-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/848-61-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/848-63-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/848-57-0x000000000040748E-mapping.dmp
-
memory/848-56-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1536-76-0x0000000001F36000-0x0000000001F47000-memory.dmpFilesize
68KB
-
memory/1536-75-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/1536-74-0x0000000001F36000-0x0000000001F47000-memory.dmpFilesize
68KB
-
memory/1536-68-0x0000000000000000-mapping.dmp
-
memory/1536-73-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/1692-64-0x0000000000A06000-0x0000000000A17000-memory.dmpFilesize
68KB
-
memory/1692-55-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/1692-66-0x0000000000A06000-0x0000000000A17000-memory.dmpFilesize
68KB
-
memory/1692-65-0x0000000074420000-0x00000000749CB000-memory.dmpFilesize
5.7MB
-
memory/1692-54-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB