Analysis
-
max time kernel
177s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 15:21
Static task
static1
Behavioral task
behavioral1
Sample
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
Resource
win10v2004-20220812-en
General
-
Target
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe
-
Size
290KB
-
MD5
6a890900f264d91b22368ece3b4c2ec0
-
SHA1
c7f9facce25fde3e168068beb8e2e0d002a1fc80
-
SHA256
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f
-
SHA512
1addbf55230369de0e8fe5e572595b3b20248bcce4c824e1ab3a8deeb73dfa678034cfbee953cee79b439a7bde4b678df0c947b60a7fde9e6f6fcf89c16ba87e
-
SSDEEP
3072:nMY0O8BEMxRURH1S6Ll65S69q/N6LcaubmmeeleYugci1ze7AdkddcdrFWJw7rr/:MY03M1S6kL1OEG2xFjX9M
Malware Config
Extracted
njrat
0.6.4
victime
badprince.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Trojan.exeTrojan.exepid process 4948 Trojan.exe 3896 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exeTrojan.exedescription pid process target process PID 2736 set thread context of 1028 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe PID 4948 set thread context of 3896 4948 Trojan.exe Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Trojan.exepid process 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe 3896 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exeTrojan.exeTrojan.exedescription pid process Token: SeDebugPrivilege 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe Token: SeDebugPrivilege 4948 Trojan.exe Token: SeDebugPrivilege 3896 Trojan.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exeTrojan.exeTrojan.exedescription pid process target process PID 2736 wrote to memory of 1028 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe PID 2736 wrote to memory of 1028 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe PID 2736 wrote to memory of 1028 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe PID 2736 wrote to memory of 1028 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe PID 2736 wrote to memory of 1028 2736 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe PID 1028 wrote to memory of 4948 1028 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe Trojan.exe PID 1028 wrote to memory of 4948 1028 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe Trojan.exe PID 1028 wrote to memory of 4948 1028 0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe Trojan.exe PID 4948 wrote to memory of 3896 4948 Trojan.exe Trojan.exe PID 4948 wrote to memory of 3896 4948 Trojan.exe Trojan.exe PID 4948 wrote to memory of 3896 4948 Trojan.exe Trojan.exe PID 4948 wrote to memory of 3896 4948 Trojan.exe Trojan.exe PID 4948 wrote to memory of 3896 4948 Trojan.exe Trojan.exe PID 3896 wrote to memory of 4428 3896 Trojan.exe netsh.exe PID 3896 wrote to memory of 4428 3896 Trojan.exe netsh.exe PID 3896 wrote to memory of 4428 3896 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe"C:\Users\Admin\AppData\Local\Temp\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exeC:\Users\Admin\AppData\Local\Temp\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
290KB
MD56a890900f264d91b22368ece3b4c2ec0
SHA1c7f9facce25fde3e168068beb8e2e0d002a1fc80
SHA2560289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f
SHA5121addbf55230369de0e8fe5e572595b3b20248bcce4c824e1ab3a8deeb73dfa678034cfbee953cee79b439a7bde4b678df0c947b60a7fde9e6f6fcf89c16ba87e
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
290KB
MD56a890900f264d91b22368ece3b4c2ec0
SHA1c7f9facce25fde3e168068beb8e2e0d002a1fc80
SHA2560289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f
SHA5121addbf55230369de0e8fe5e572595b3b20248bcce4c824e1ab3a8deeb73dfa678034cfbee953cee79b439a7bde4b678df0c947b60a7fde9e6f6fcf89c16ba87e
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
290KB
MD56a890900f264d91b22368ece3b4c2ec0
SHA1c7f9facce25fde3e168068beb8e2e0d002a1fc80
SHA2560289a8b04866b8426c003247d27b58ea05d4f3765e30c0c414380c833b9e516f
SHA5121addbf55230369de0e8fe5e572595b3b20248bcce4c824e1ab3a8deeb73dfa678034cfbee953cee79b439a7bde4b678df0c947b60a7fde9e6f6fcf89c16ba87e
-
memory/1028-138-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1028-137-0x0000000000000000-mapping.dmp
-
memory/2736-132-0x0000000000B20000-0x0000000000B6E000-memory.dmpFilesize
312KB
-
memory/2736-136-0x0000000005690000-0x000000000572C000-memory.dmpFilesize
624KB
-
memory/2736-135-0x00000000053D0000-0x00000000053DA000-memory.dmpFilesize
40KB
-
memory/2736-134-0x0000000005450000-0x00000000054E2000-memory.dmpFilesize
584KB
-
memory/2736-133-0x0000000005A00000-0x0000000005FA4000-memory.dmpFilesize
5.6MB
-
memory/3896-143-0x0000000000000000-mapping.dmp
-
memory/4428-146-0x0000000000000000-mapping.dmp
-
memory/4948-139-0x0000000000000000-mapping.dmp