Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 03:15
Behavioral task
behavioral1
Sample
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe
Resource
win10v2004-20220812-en
General
-
Target
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe
-
Size
166KB
-
MD5
67883f8a4f7243bbf4f5bcd30ac0fd7d
-
SHA1
461d4783878d207900dff1043bdb5f2cdcd8165e
-
SHA256
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6
-
SHA512
f4aeb17bd4629930d9990c6c2f2e8f33de901a1ace957799752dcbbbf73bdf11829c6d15f75f70e5977a6f23872297928b1330201aef9afc8af4f6e46e561dfe
-
SSDEEP
1536:9keWklluiIPOuaxrgJeu4a6IM8YgPAdmRUcTOZYAC1nlqCSk5kHyiWji1NL:9/XuDt4Neq
Malware Config
Extracted
njrat
0.6.4
HacKed
127.0.0.1:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tmp.exeTrojan.exepid process 2036 tmp.exe 268 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
WScript.exetmp.exepid process 1020 WScript.exe 2036 tmp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Trojan.exepid process 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe 268 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 268 Trojan.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exeWScript.exetmp.exeTrojan.exedescription pid process target process PID 1972 wrote to memory of 1020 1972 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 1972 wrote to memory of 1020 1972 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 1972 wrote to memory of 1020 1972 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 1972 wrote to memory of 1020 1972 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 1020 wrote to memory of 2036 1020 WScript.exe tmp.exe PID 1020 wrote to memory of 2036 1020 WScript.exe tmp.exe PID 1020 wrote to memory of 2036 1020 WScript.exe tmp.exe PID 1020 wrote to memory of 2036 1020 WScript.exe tmp.exe PID 2036 wrote to memory of 268 2036 tmp.exe Trojan.exe PID 2036 wrote to memory of 268 2036 tmp.exe Trojan.exe PID 2036 wrote to memory of 268 2036 tmp.exe Trojan.exe PID 2036 wrote to memory of 268 2036 tmp.exe Trojan.exe PID 268 wrote to memory of 576 268 Trojan.exe netsh.exe PID 268 wrote to memory of 576 268 Trojan.exe netsh.exe PID 268 wrote to memory of 576 268 Trojan.exe netsh.exe PID 268 wrote to memory of 576 268 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe"C:\Users\Admin\AppData\Local\Temp\c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Facebook hacker password.vbs"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Facebook hacker password.vbsFilesize
58KB
MD55e6ffcb08eae38fa82bdfe9d185932af
SHA1383655aa4ba3a642ceb306f4c1f43f36863829b7
SHA2562bea79d80223f5ed912da9b25b2053011ca9a1b5a2166a1aa5e5cf022cfe668e
SHA512716af1377a715dd74912cbcfbe7bfcd525d87af314ccd33c2c31c593c304ddaedcd62df6f6a589cfaa229f41b713aa7b61a7c987abdebf2bee4b735cdb19088a
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
memory/268-64-0x0000000000000000-mapping.dmp
-
memory/268-70-0x0000000073A20000-0x0000000073FCB000-memory.dmpFilesize
5.7MB
-
memory/268-72-0x0000000073A20000-0x0000000073FCB000-memory.dmpFilesize
5.7MB
-
memory/576-68-0x0000000000000000-mapping.dmp
-
memory/1020-55-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x0000000075981000-0x0000000075983000-memory.dmpFilesize
8KB
-
memory/2036-59-0x0000000000000000-mapping.dmp
-
memory/2036-69-0x0000000073A20000-0x0000000073FCB000-memory.dmpFilesize
5.7MB