Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 00:45
Behavioral task
behavioral1
Sample
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe
Resource
win10v2004-20220812-en
General
-
Target
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe
-
Size
23KB
-
MD5
734a72fa06938e7beaed1e07c1508e20
-
SHA1
842062e2130b3a7cfa97124a9a18f6b35ffbdac5
-
SHA256
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
-
SHA512
3e215b2be4434317ca49f1d62fb3bf4bca3ed41aeca1c67bd94dc43a39e47af3263277da5f8ff67641fc8aa8e5e95ff0c5c4be6239da5d333f691693bc38d517
-
SSDEEP
384:U8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZCF:zXcwt3tRpcnuV
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:1337
5f76cab4062f3ff0306d0a613b00c588
-
reg_key
5f76cab4062f3ff0306d0a613b00c588
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 632 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f76cab4062f3ff0306d0a613b00c588.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f76cab4062f3ff0306d0a613b00c588.exe server.exe -
Loads dropped DLL 1 IoCs
Processes:
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exepid process 756 bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5f76cab4062f3ff0306d0a613b00c588 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5f76cab4062f3ff0306d0a613b00c588 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exeserver.exedescription pid process target process PID 756 wrote to memory of 632 756 bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe server.exe PID 756 wrote to memory of 632 756 bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe server.exe PID 756 wrote to memory of 632 756 bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe server.exe PID 756 wrote to memory of 632 756 bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe server.exe PID 632 wrote to memory of 1364 632 server.exe netsh.exe PID 632 wrote to memory of 1364 632 server.exe netsh.exe PID 632 wrote to memory of 1364 632 server.exe netsh.exe PID 632 wrote to memory of 1364 632 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe"C:\Users\Admin\AppData\Local\Temp\bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD5734a72fa06938e7beaed1e07c1508e20
SHA1842062e2130b3a7cfa97124a9a18f6b35ffbdac5
SHA256bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
SHA5123e215b2be4434317ca49f1d62fb3bf4bca3ed41aeca1c67bd94dc43a39e47af3263277da5f8ff67641fc8aa8e5e95ff0c5c4be6239da5d333f691693bc38d517
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD5734a72fa06938e7beaed1e07c1508e20
SHA1842062e2130b3a7cfa97124a9a18f6b35ffbdac5
SHA256bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
SHA5123e215b2be4434317ca49f1d62fb3bf4bca3ed41aeca1c67bd94dc43a39e47af3263277da5f8ff67641fc8aa8e5e95ff0c5c4be6239da5d333f691693bc38d517
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
23KB
MD5734a72fa06938e7beaed1e07c1508e20
SHA1842062e2130b3a7cfa97124a9a18f6b35ffbdac5
SHA256bd33e8551fd1f2160b5579bb3bbeac5cbc5b85eeb3fc33094dbac8675019d763
SHA5123e215b2be4434317ca49f1d62fb3bf4bca3ed41aeca1c67bd94dc43a39e47af3263277da5f8ff67641fc8aa8e5e95ff0c5c4be6239da5d333f691693bc38d517
-
memory/632-57-0x0000000000000000-mapping.dmp
-
memory/632-62-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/632-65-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/756-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/756-55-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/756-61-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/1364-63-0x0000000000000000-mapping.dmp