Analysis
-
max time kernel
150s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 02:01
Behavioral task
behavioral1
Sample
5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe
Resource
win10v2004-20220812-en
General
-
Target
5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe
-
Size
29KB
-
MD5
42069907e8aea8dcff5427a86e729620
-
SHA1
ecd9f062e6f56145b9355c78ad4e8a162168ca09
-
SHA256
5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191
-
SHA512
83fb3ecc301a664d058a2bb39dc21b3e504ef6fb406cc1676e0c90368ec7a7807e5eeef6ea40832af3893f80c37c7f51c2acecb680132b29c623fb647bfd507a
-
SSDEEP
768:L+7hoKoGJFNK4Aq1RehBKh0p29SgR4bAs:K7hdKPg6KhG29j4bAs
Malware Config
Extracted
njrat
0.6.4
chrome
127.0.0.1:1177
d5a38e9b5f206c41f8851bf04a251d26
-
reg_key
d5a38e9b5f206c41f8851bf04a251d26
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 1752 chrome.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5a38e9b5f206c41f8851bf04a251d26.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5a38e9b5f206c41f8851bf04a251d26.exe chrome.exe -
Loads dropped DLL 1 IoCs
Processes:
5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exepid process 1764 5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exepid process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 1752 chrome.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exechrome.exedescription pid process target process PID 1764 wrote to memory of 1752 1764 5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe chrome.exe PID 1764 wrote to memory of 1752 1764 5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe chrome.exe PID 1764 wrote to memory of 1752 1764 5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe chrome.exe PID 1764 wrote to memory of 1752 1764 5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe chrome.exe PID 1752 wrote to memory of 1512 1752 chrome.exe netsh.exe PID 1752 wrote to memory of 1512 1752 chrome.exe netsh.exe PID 1752 wrote to memory of 1512 1752 chrome.exe netsh.exe PID 1752 wrote to memory of 1512 1752 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe"C:\Users\Admin\AppData\Local\Temp\5ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD542069907e8aea8dcff5427a86e729620
SHA1ecd9f062e6f56145b9355c78ad4e8a162168ca09
SHA2565ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191
SHA51283fb3ecc301a664d058a2bb39dc21b3e504ef6fb406cc1676e0c90368ec7a7807e5eeef6ea40832af3893f80c37c7f51c2acecb680132b29c623fb647bfd507a
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD542069907e8aea8dcff5427a86e729620
SHA1ecd9f062e6f56145b9355c78ad4e8a162168ca09
SHA2565ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191
SHA51283fb3ecc301a664d058a2bb39dc21b3e504ef6fb406cc1676e0c90368ec7a7807e5eeef6ea40832af3893f80c37c7f51c2acecb680132b29c623fb647bfd507a
-
\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD542069907e8aea8dcff5427a86e729620
SHA1ecd9f062e6f56145b9355c78ad4e8a162168ca09
SHA2565ae4bcbe93194d56a314afcf41d3c1ed96338bcd9a0d26d503d0f971bd519191
SHA51283fb3ecc301a664d058a2bb39dc21b3e504ef6fb406cc1676e0c90368ec7a7807e5eeef6ea40832af3893f80c37c7f51c2acecb680132b29c623fb647bfd507a
-
memory/1512-62-0x0000000000000000-mapping.dmp
-
memory/1752-57-0x0000000000000000-mapping.dmp
-
memory/1752-64-0x0000000074A40000-0x0000000074FEB000-memory.dmpFilesize
5.7MB
-
memory/1752-65-0x0000000074A40000-0x0000000074FEB000-memory.dmpFilesize
5.7MB
-
memory/1764-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1764-55-0x0000000074A40000-0x0000000074FEB000-memory.dmpFilesize
5.7MB
-
memory/1764-61-0x0000000074A40000-0x0000000074FEB000-memory.dmpFilesize
5.7MB