Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 20:22
Behavioral task
behavioral1
Sample
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe
Resource
win10v2004-20220901-en
General
-
Target
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe
-
Size
23KB
-
MD5
41f484184aeefc393ba62b04f3fbe940
-
SHA1
91f26bbe1141432de96deba534c08a542ac4386e
-
SHA256
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
-
SHA512
0b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
SSDEEP
384:aweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZq+6:FLq411eRpcnud
Malware Config
Extracted
njrat
0.7d
HacKed
mohammed29928.ddns.net:5552
29867abf0d27f9d1f7944939dd33f982
-
reg_key
29867abf0d27f9d1f7944939dd33f982
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 216 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe -
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29867abf0d27f9d1f7944939dd33f982.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29867abf0d27f9d1f7944939dd33f982.exe server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\29867abf0d27f9d1f7944939dd33f982 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\29867abf0d27f9d1f7944939dd33f982 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe Token: 33 216 server.exe Token: SeIncBasePriorityPrivilege 216 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exeserver.exedescription pid process target process PID 2356 wrote to memory of 216 2356 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 2356 wrote to memory of 216 2356 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 2356 wrote to memory of 216 2356 22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe server.exe PID 216 wrote to memory of 3148 216 server.exe netsh.exe PID 216 wrote to memory of 3148 216 server.exe netsh.exe PID 216 wrote to memory of 3148 216 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe"C:\Users\Admin\AppData\Local\Temp\22de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD541f484184aeefc393ba62b04f3fbe940
SHA191f26bbe1141432de96deba534c08a542ac4386e
SHA25622de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
SHA5120b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD541f484184aeefc393ba62b04f3fbe940
SHA191f26bbe1141432de96deba534c08a542ac4386e
SHA25622de0c7cb2ce9b7f3e5fc6944bda2454c13d1e57476b0b7cfc835d3b4edf6cb7
SHA5120b6e8d7681090e24138b3ee8ad3f44712a497f9d9c6e6f6aa0e9f26a82c47b5ee2de5404dcc19b0abbbe4717a6ca4ff04110dfdd44c1a7dd84b35f0a5bfaaaf8
-
memory/216-133-0x0000000000000000-mapping.dmp
-
memory/216-137-0x0000000075500000-0x0000000075AB1000-memory.dmpFilesize
5.7MB
-
memory/216-139-0x0000000075500000-0x0000000075AB1000-memory.dmpFilesize
5.7MB
-
memory/2356-132-0x0000000075500000-0x0000000075AB1000-memory.dmpFilesize
5.7MB
-
memory/2356-136-0x0000000075500000-0x0000000075AB1000-memory.dmpFilesize
5.7MB
-
memory/3148-138-0x0000000000000000-mapping.dmp