Analysis
-
max time kernel
152s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 09:07
Static task
static1
Behavioral task
behavioral1
Sample
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe
Resource
win10v2004-20220812-en
General
-
Target
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe
-
Size
59KB
-
MD5
73b76081380127c9945b404a2e7cae90
-
SHA1
84ab59754437b503ff879f7508fe01ba2e546e9f
-
SHA256
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
-
SHA512
43fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
SSDEEP
768:mJv3kWdVTiSz9Wls8iQh8BvbzinvHc2JscuqvqJPnmgl5Lk5xb4VjHpAh8bDXwVU:03R8H9Js5Lk5dO6V/MJEMCK/RXQ
Malware Config
Extracted
njrat
0.6.4
HacKed
directlink.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 1780 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 1 IoCs
Processes:
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exepid process 548 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Trojan.exepid process 1780 Trojan.exe 1780 Trojan.exe 1780 Trojan.exe 1780 Trojan.exe 1780 Trojan.exe 1780 Trojan.exe 1780 Trojan.exe 1780 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 1780 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exeTrojan.exedescription pid process target process PID 548 wrote to memory of 1780 548 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 548 wrote to memory of 1780 548 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 548 wrote to memory of 1780 548 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 548 wrote to memory of 1780 548 c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe Trojan.exe PID 1780 wrote to memory of 1284 1780 Trojan.exe netsh.exe PID 1780 wrote to memory of 1284 1780 Trojan.exe netsh.exe PID 1780 wrote to memory of 1284 1780 Trojan.exe netsh.exe PID 1780 wrote to memory of 1284 1780 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe"C:\Users\Admin\AppData\Local\Temp\c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
59KB
MD573b76081380127c9945b404a2e7cae90
SHA184ab59754437b503ff879f7508fe01ba2e546e9f
SHA256c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
SHA51243fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
59KB
MD573b76081380127c9945b404a2e7cae90
SHA184ab59754437b503ff879f7508fe01ba2e546e9f
SHA256c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
SHA51243fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
59KB
MD573b76081380127c9945b404a2e7cae90
SHA184ab59754437b503ff879f7508fe01ba2e546e9f
SHA256c3204158f6385fca0f872d271655c8329c291c94074eabace8045c225ab9685c
SHA51243fa7892f314c565b7b2bfe92dc94ed0ca29b6d5ff0cf1e4830c78d5310078b9f11b96c6b3d6d734bcb8d7c241ce71e7d054a0a6a18faa92c7f4c22571d4cda6
-
memory/548-54-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/548-55-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/548-56-0x00000000005C0000-0x00000000005CA000-memory.dmpFilesize
40KB
-
memory/548-57-0x0000000001DB0000-0x0000000001DBE000-memory.dmpFilesize
56KB
-
memory/1284-63-0x0000000000000000-mapping.dmp
-
memory/1780-59-0x0000000000000000-mapping.dmp
-
memory/1780-65-0x00000000049D5000-0x00000000049E6000-memory.dmpFilesize
68KB
-
memory/1780-66-0x00000000049D5000-0x00000000049E6000-memory.dmpFilesize
68KB