Analysis
-
max time kernel
151s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 20:22
Behavioral task
behavioral1
Sample
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe
Resource
win10v2004-20220901-en
General
-
Target
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe
-
Size
23KB
-
MD5
41f484184aeefc393ba62b04f3fbe940
-
SHA1
91f26bbe1141432de96deba534c08a542ac4386e
-
SHA256
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
-
SHA512
0b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
SSDEEP
384:aweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZq+6:FLq411eRpcnud
Malware Config
Extracted
njrat
0.7d
HacKed
mohammed29928.ddns.net:5552
29867abf0d27f9d1f7944939dd33f982
-
reg_key
29867abf0d27f9d1f7944939dd33f982
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 1768 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29867abf0d27f9d1f7944939dd33f982.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29867abf0d27f9d1f7944939dd33f982.exe server.exe -
Loads dropped DLL 1 IoCs
Processes:
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exepid process 1880 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\29867abf0d27f9d1f7944939dd33f982 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\29867abf0d27f9d1f7944939dd33f982 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe Token: 33 1768 server.exe Token: SeIncBasePriorityPrivilege 1768 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exeserver.exedescription pid process target process PID 1880 wrote to memory of 1768 1880 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 1880 wrote to memory of 1768 1880 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 1880 wrote to memory of 1768 1880 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 1880 wrote to memory of 1768 1880 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 1768 wrote to memory of 952 1768 server.exe netsh.exe PID 1768 wrote to memory of 952 1768 server.exe netsh.exe PID 1768 wrote to memory of 952 1768 server.exe netsh.exe PID 1768 wrote to memory of 952 1768 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe"C:\Users\Admin\AppData\Local\Temp\22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD541f484184aeefc393ba62b04f3fbe940
SHA191f26bbe1141432de96deba534c08a542ac4386e
SHA25622de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
SHA5120b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD541f484184aeefc393ba62b04f3fbe940
SHA191f26bbe1141432de96deba534c08a542ac4386e
SHA25622de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
SHA5120b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD541f484184aeefc393ba62b04f3fbe940
SHA191f26bbe1141432de96deba534c08a542ac4386e
SHA25622de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
SHA5120b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
memory/952-63-0x0000000000000000-mapping.dmp
-
memory/1768-57-0x0000000000000000-mapping.dmp
-
memory/1768-62-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1768-65-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1880-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1880-55-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/1880-61-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB