Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 01:57
Static task
static1
Behavioral task
behavioral1
Sample
87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe
Resource
win7-20220901-en
General
-
Target
87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe
-
Size
108KB
-
MD5
6c1ee36aacf5079d4d537ebd2fc5f148
-
SHA1
5325df501e2bccd44c262445e8015ea6dd9de647
-
SHA256
87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960
-
SHA512
1d0386f239beae85e850fd7adeccf6bf709ae3647aeaa0dcfc8cd00d2d6464eaa3a029c1451cc9b29f2e1acfcee8415f18c287bf3e84d7f366872a2c8436f8d4
-
SSDEEP
1536:WbnRoHJT3p+KADy00wJk2/uJOo/Yl2v0Som2hsDQwBTyYqjPvZO4w4:WbRopDpuz/ucoglG+fSDPQYqjPQ4w4
Malware Config
Extracted
njrat
0.6.4
HacKed
funkymalware.zapto.org:1177
468488565f27c01a98cb0ac6112a97d0
-
reg_key
468488565f27c01a98cb0ac6112a97d0
-
splitter
|'|'|
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exedescription pid process target process PID 1988 set thread context of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exevbc.exedescription pid process target process PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1988 wrote to memory of 1936 1988 87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe vbc.exe PID 1936 wrote to memory of 1940 1936 vbc.exe dw20.exe PID 1936 wrote to memory of 1940 1936 vbc.exe dw20.exe PID 1936 wrote to memory of 1940 1936 vbc.exe dw20.exe PID 1936 wrote to memory of 1940 1936 vbc.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe"C:\Users\Admin\AppData\Local\Temp\87e1732dae8a72a8ab46360f9db9e38ceeeab05fa1492d507a346ad32a092960.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4123⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1936-61-0x0000000000408B0E-mapping.dmp
-
memory/1936-55-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1936-56-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1936-58-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1936-59-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1936-60-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1936-63-0x0000000000402000-0x0000000000408C00-memory.dmpFilesize
27KB
-
memory/1936-64-0x0000000000402000-0x0000000000408C00-memory.dmpFilesize
27KB
-
memory/1936-69-0x0000000074850000-0x0000000074DFB000-memory.dmpFilesize
5.7MB
-
memory/1936-70-0x0000000074850000-0x0000000074DFB000-memory.dmpFilesize
5.7MB
-
memory/1940-66-0x0000000000000000-mapping.dmp
-
memory/1988-54-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1988-67-0x0000000074850000-0x0000000074DFB000-memory.dmpFilesize
5.7MB