Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 14:46
Static task
static1
Behavioral task
behavioral1
Sample
ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe
Resource
win10v2004-20220901-en
General
-
Target
ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe
-
Size
338KB
-
MD5
66cb58b83a174b565129d99b2236af80
-
SHA1
77943715633b6b028da8e6e90e9bdfdd4f0a2c59
-
SHA256
ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478
-
SHA512
2df04457ca3fd9e94a1487ec765615dd884888f38ab654d369bebf64d27bed6bcc6321f50e647758e9f95c71980edbcbc66cfddf9a4d6c376ee63819668983e9
-
SSDEEP
3072:uGnurkvWoy0+w6jpGyFWWH27TkJionKuS6:uGpWpPW/EC
Malware Config
Extracted
njrat
0.6.4
HacKed
vbre231.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Tempserver.exeTempserver.exeTrojan.exeTrojan.exepid process 944 Tempserver.exe 1980 Tempserver.exe 840 Trojan.exe 276 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
Tempserver.exeTrojan.exepid process 1980 Tempserver.exe 840 Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Tempserver.exeTrojan.exedescription pid process target process PID 944 set thread context of 1980 944 Tempserver.exe Tempserver.exe PID 840 set thread context of 276 840 Trojan.exe Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Trojan.exepid process 276 Trojan.exe 276 Trojan.exe 276 Trojan.exe 276 Trojan.exe 276 Trojan.exe 276 Trojan.exe 276 Trojan.exe 276 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Tempserver.exeTrojan.exeTrojan.exedescription pid process Token: SeDebugPrivilege 944 Tempserver.exe Token: SeDebugPrivilege 840 Trojan.exe Token: SeDebugPrivilege 276 Trojan.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exeTempserver.exeTempserver.exeTrojan.exeTrojan.exedescription pid process target process PID 1504 wrote to memory of 944 1504 ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe Tempserver.exe PID 1504 wrote to memory of 944 1504 ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe Tempserver.exe PID 1504 wrote to memory of 944 1504 ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe Tempserver.exe PID 1504 wrote to memory of 944 1504 ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe Tempserver.exe PID 944 wrote to memory of 1980 944 Tempserver.exe Tempserver.exe PID 944 wrote to memory of 1980 944 Tempserver.exe Tempserver.exe PID 944 wrote to memory of 1980 944 Tempserver.exe Tempserver.exe PID 944 wrote to memory of 1980 944 Tempserver.exe Tempserver.exe PID 944 wrote to memory of 1980 944 Tempserver.exe Tempserver.exe PID 944 wrote to memory of 1980 944 Tempserver.exe Tempserver.exe PID 1980 wrote to memory of 840 1980 Tempserver.exe Trojan.exe PID 1980 wrote to memory of 840 1980 Tempserver.exe Trojan.exe PID 1980 wrote to memory of 840 1980 Tempserver.exe Trojan.exe PID 1980 wrote to memory of 840 1980 Tempserver.exe Trojan.exe PID 840 wrote to memory of 276 840 Trojan.exe Trojan.exe PID 840 wrote to memory of 276 840 Trojan.exe Trojan.exe PID 840 wrote to memory of 276 840 Trojan.exe Trojan.exe PID 840 wrote to memory of 276 840 Trojan.exe Trojan.exe PID 840 wrote to memory of 276 840 Trojan.exe Trojan.exe PID 840 wrote to memory of 276 840 Trojan.exe Trojan.exe PID 276 wrote to memory of 1348 276 Trojan.exe netsh.exe PID 276 wrote to memory of 1348 276 Trojan.exe netsh.exe PID 276 wrote to memory of 1348 276 Trojan.exe netsh.exe PID 276 wrote to memory of 1348 276 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe"C:\Users\Admin\AppData\Local\Temp\ab66c6e473af8c24d185b542dbcd204af0daf9d220ff97861deabb86ac636478.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Tempserver.exe"C:\Users\Admin\AppData\Local\Tempserver.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Tempserver.exeC:\Users\Admin\AppData\Local\Tempserver.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE6⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
C:\Users\Admin\AppData\Local\Tempserver.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
C:\Users\Admin\AppData\Local\Tempserver.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
C:\Users\Admin\AppData\Local\Tempserver.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
283KB
MD545bedbaaa0e6b33ca6d2c20ce6487e6b
SHA1eb5583d2ce459c311ba5ce0a2a9e729c0a09a4a2
SHA2561581b65e663cc2d6a6e645801306629618a323ef4ee757a45496ce3490405f6b
SHA5126130a1b3736eb45262df5fe2b8c153ab0177ccb9f1a5737f541dc331a5c80433b6624cd1d60d0c7189a677feea3b122a1acd090f4edcbdcc816928a13c9b86e4
-
memory/276-79-0x0000000000408AFE-mapping.dmp
-
memory/276-90-0x0000000004DE5000-0x0000000004DF6000-memory.dmpFilesize
68KB
-
memory/840-75-0x00000000008B0000-0x00000000008FC000-memory.dmpFilesize
304KB
-
memory/840-87-0x0000000004DA5000-0x0000000004DB6000-memory.dmpFilesize
68KB
-
memory/840-72-0x0000000000000000-mapping.dmp
-
memory/944-60-0x0000000000E80000-0x0000000000ECC000-memory.dmpFilesize
304KB
-
memory/944-62-0x0000000000470000-0x000000000047A000-memory.dmpFilesize
40KB
-
memory/944-61-0x0000000075ED1000-0x0000000075ED3000-memory.dmpFilesize
8KB
-
memory/944-86-0x0000000004B75000-0x0000000004B86000-memory.dmpFilesize
68KB
-
memory/944-56-0x0000000000000000-mapping.dmp
-
memory/1348-85-0x0000000000000000-mapping.dmp
-
memory/1504-54-0x000007FEF47A0000-0x000007FEF51C3000-memory.dmpFilesize
10.1MB
-
memory/1504-59-0x0000000001F56000-0x0000000001F75000-memory.dmpFilesize
124KB
-
memory/1504-55-0x000007FEF3330000-0x000007FEF43C6000-memory.dmpFilesize
16.6MB
-
memory/1980-69-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1980-67-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1980-64-0x0000000000408AFE-mapping.dmp
-
memory/1980-63-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB