Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 20:22
Behavioral task
behavioral1
Sample
28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe
Resource
win10v2004-20220812-en
General
-
Target
28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe
-
Size
256KB
-
MD5
73bd3bdeb4a75c3ff74a7935ddac9c80
-
SHA1
6ce1bd6708038d57673a06052940f30e318ffdb1
-
SHA256
28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e
-
SHA512
bcad6326216c1f38f746c04b983b62935c81c61857e02a1825ad4e58d0f0d7cff4e1821c2ded20e8e81145fb6041dc7034d723030a19d18571eca5a0cbb4c4d2
-
SSDEEP
6144:RmfAQ369AGxNWJHzMK7pqfeJs4s1zLnlBX+UVes/d:RvVxN4HzLq2KxBX+AeG
Malware Config
Extracted
njrat
0.6.4
HacKed
win123.no-ip.biz:1177
470fceaa18ffd7ea15451e9bd351fd87
-
reg_key
470fceaa18ffd7ea15451e9bd351fd87
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocalbcN_WXrQOb.exeFirefox.exepid process 4800 LocalbcN_WXrQOb.exe 3488 Firefox.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exeLocalbcN_WXrQOb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation LocalbcN_WXrQOb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Firefox.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\470fceaa18ffd7ea15451e9bd351fd87 = "\"C:\\ProgramData\\Firefox.exe\" .." Firefox.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\470fceaa18ffd7ea15451e9bd351fd87 = "\"C:\\ProgramData\\Firefox.exe\" .." Firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
Firefox.exepid process 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe 3488 Firefox.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Firefox.exedescription pid process Token: SeDebugPrivilege 3488 Firefox.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exeLocalbcN_WXrQOb.exeFirefox.exedescription pid process target process PID 4528 wrote to memory of 4800 4528 28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe LocalbcN_WXrQOb.exe PID 4528 wrote to memory of 4800 4528 28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe LocalbcN_WXrQOb.exe PID 4528 wrote to memory of 4800 4528 28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe LocalbcN_WXrQOb.exe PID 4800 wrote to memory of 3488 4800 LocalbcN_WXrQOb.exe Firefox.exe PID 4800 wrote to memory of 3488 4800 LocalbcN_WXrQOb.exe Firefox.exe PID 4800 wrote to memory of 3488 4800 LocalbcN_WXrQOb.exe Firefox.exe PID 3488 wrote to memory of 4708 3488 Firefox.exe netsh.exe PID 3488 wrote to memory of 4708 3488 Firefox.exe netsh.exe PID 3488 wrote to memory of 4708 3488 Firefox.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe"C:\Users\Admin\AppData\Local\Temp\28d0076db09d89709ef2d882d69aa9a171fceb3c12669b28c46e08ce64ed700e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocalbcN_WXrQOb.exe"C:\Users\Admin\AppData\LocalbcN_WXrQOb.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Firefox.exe"C:\ProgramData\Firefox.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\Firefox.exe" "Firefox.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Firefox.exeFilesize
29KB
MD542484c5a2b76757e8bdc1e48ce71be74
SHA110a130799ef29aa0be4b93147859510b54f09b22
SHA256933c8a326c3f52412684d20ac9bfa1fa0a78cef6d7a8f9719dd19a799d74565c
SHA5124c7fbce06cdb2e4d82ffbc79dfaa8161d7b8264589d3109e913cc61ea7dfb6071cf5dc301b065c4430d40ea51c18420f8efcedaf1dc4d8333555b5f41dd4be09
-
C:\ProgramData\Firefox.exeFilesize
29KB
MD542484c5a2b76757e8bdc1e48ce71be74
SHA110a130799ef29aa0be4b93147859510b54f09b22
SHA256933c8a326c3f52412684d20ac9bfa1fa0a78cef6d7a8f9719dd19a799d74565c
SHA5124c7fbce06cdb2e4d82ffbc79dfaa8161d7b8264589d3109e913cc61ea7dfb6071cf5dc301b065c4430d40ea51c18420f8efcedaf1dc4d8333555b5f41dd4be09
-
C:\Users\Admin\AppData\LocalbcN_WXrQOb.exeFilesize
29KB
MD542484c5a2b76757e8bdc1e48ce71be74
SHA110a130799ef29aa0be4b93147859510b54f09b22
SHA256933c8a326c3f52412684d20ac9bfa1fa0a78cef6d7a8f9719dd19a799d74565c
SHA5124c7fbce06cdb2e4d82ffbc79dfaa8161d7b8264589d3109e913cc61ea7dfb6071cf5dc301b065c4430d40ea51c18420f8efcedaf1dc4d8333555b5f41dd4be09
-
C:\Users\Admin\AppData\LocalbcN_WXrQOb.exeFilesize
29KB
MD542484c5a2b76757e8bdc1e48ce71be74
SHA110a130799ef29aa0be4b93147859510b54f09b22
SHA256933c8a326c3f52412684d20ac9bfa1fa0a78cef6d7a8f9719dd19a799d74565c
SHA5124c7fbce06cdb2e4d82ffbc79dfaa8161d7b8264589d3109e913cc61ea7dfb6071cf5dc301b065c4430d40ea51c18420f8efcedaf1dc4d8333555b5f41dd4be09
-
memory/3488-137-0x0000000000000000-mapping.dmp
-
memory/3488-142-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/3488-143-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/4528-132-0x00007FF812F20000-0x00007FF813956000-memory.dmpFilesize
10.2MB
-
memory/4708-141-0x0000000000000000-mapping.dmp
-
memory/4800-133-0x0000000000000000-mapping.dmp
-
memory/4800-136-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB
-
memory/4800-140-0x0000000074E30000-0x00000000753E1000-memory.dmpFilesize
5.7MB