Analysis
-
max time kernel
152s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 20:32
Static task
static1
Behavioral task
behavioral1
Sample
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe
Resource
win10v2004-20220812-en
General
-
Target
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe
-
Size
19KB
-
MD5
7bfa508192c2639b347bd1c63e097cb0
-
SHA1
321a334588a603412ab81a33118f4a5ec89138e4
-
SHA256
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
-
SHA512
eda8f40b374ccd01cf698b9bfb317710be95f2de63987f61da39ac082ae3125afee9a1c33b204b3e2ab3e3c7e5cd1afea3a8859b7384817331a4960d9c9aad59
-
SSDEEP
384:HYSuWym/VaXoBqQLNHYA1kuhbGs1ABpp3GUD8eMcz2kmp:Hxx4XZ2H9TS3jWcz1mp
Malware Config
Extracted
njrat
0.6.4
HacKed
hackali12121.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 1304 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
Trojan.exepid process 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe 1304 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 1304 Trojan.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exeTrojan.exedescription pid process target process PID 1212 wrote to memory of 1304 1212 607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe Trojan.exe PID 1212 wrote to memory of 1304 1212 607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe Trojan.exe PID 1212 wrote to memory of 1304 1212 607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe Trojan.exe PID 1304 wrote to memory of 1952 1304 Trojan.exe netsh.exe PID 1304 wrote to memory of 1952 1304 Trojan.exe netsh.exe PID 1304 wrote to memory of 1952 1304 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe"C:\Users\Admin\AppData\Local\Temp\607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
19KB
MD57bfa508192c2639b347bd1c63e097cb0
SHA1321a334588a603412ab81a33118f4a5ec89138e4
SHA256607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
SHA512eda8f40b374ccd01cf698b9bfb317710be95f2de63987f61da39ac082ae3125afee9a1c33b204b3e2ab3e3c7e5cd1afea3a8859b7384817331a4960d9c9aad59
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
19KB
MD57bfa508192c2639b347bd1c63e097cb0
SHA1321a334588a603412ab81a33118f4a5ec89138e4
SHA256607a64d67ff678e5523c13aaf2233fa89d4ecc1c9adbc7b43352b8a573a04f05
SHA512eda8f40b374ccd01cf698b9bfb317710be95f2de63987f61da39ac082ae3125afee9a1c33b204b3e2ab3e3c7e5cd1afea3a8859b7384817331a4960d9c9aad59
-
memory/1212-54-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/1212-55-0x0000000000370000-0x000000000037E000-memory.dmpFilesize
56KB
-
memory/1212-56-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmpFilesize
8KB
-
memory/1304-57-0x0000000000000000-mapping.dmp
-
memory/1304-60-0x0000000000D10000-0x0000000000D1C000-memory.dmpFilesize
48KB
-
memory/1304-63-0x000000001B326000-0x000000001B345000-memory.dmpFilesize
124KB
-
memory/1952-61-0x0000000000000000-mapping.dmp