Analysis
-
max time kernel
181s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 03:15
Behavioral task
behavioral1
Sample
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe
Resource
win10v2004-20220812-en
General
-
Target
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe
-
Size
166KB
-
MD5
67883f8a4f7243bbf4f5bcd30ac0fd7d
-
SHA1
461d4783878d207900dff1043bdb5f2cdcd8165e
-
SHA256
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6
-
SHA512
f4aeb17bd4629930d9990c6c2f2e8f33de901a1ace957799752dcbbbf73bdf11829c6d15f75f70e5977a6f23872297928b1330201aef9afc8af4f6e46e561dfe
-
SSDEEP
1536:9keWklluiIPOuaxrgJeu4a6IM8YgPAdmRUcTOZYAC1nlqCSk5kHyiWji1NL:9/XuDt4Neq
Malware Config
Extracted
njrat
0.6.4
HacKed
127.0.0.1:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tmp.exeTrojan.exepid process 4728 tmp.exe 4716 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exeWScript.exetmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation tmp.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
Trojan.exepid process 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe 4716 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 4716 Trojan.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exeWScript.exetmp.exeTrojan.exedescription pid process target process PID 4084 wrote to memory of 5092 4084 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 4084 wrote to memory of 5092 4084 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 4084 wrote to memory of 5092 4084 c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe WScript.exe PID 5092 wrote to memory of 4728 5092 WScript.exe tmp.exe PID 5092 wrote to memory of 4728 5092 WScript.exe tmp.exe PID 5092 wrote to memory of 4728 5092 WScript.exe tmp.exe PID 4728 wrote to memory of 4716 4728 tmp.exe Trojan.exe PID 4728 wrote to memory of 4716 4728 tmp.exe Trojan.exe PID 4728 wrote to memory of 4716 4728 tmp.exe Trojan.exe PID 4716 wrote to memory of 4336 4716 Trojan.exe netsh.exe PID 4716 wrote to memory of 4336 4716 Trojan.exe netsh.exe PID 4716 wrote to memory of 4336 4716 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe"C:\Users\Admin\AppData\Local\Temp\c8ef20422c8a0df56ec877110587b5e86ad4d4719f5dc4ddfcf8ec5580ab91e6.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Facebook hacker password.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Facebook hacker password.vbsFilesize
58KB
MD55e6ffcb08eae38fa82bdfe9d185932af
SHA1383655aa4ba3a642ceb306f4c1f43f36863829b7
SHA2562bea79d80223f5ed912da9b25b2053011ca9a1b5a2166a1aa5e5cf022cfe668e
SHA512716af1377a715dd74912cbcfbe7bfcd525d87af314ccd33c2c31c593c304ddaedcd62df6f6a589cfaa229f41b713aa7b61a7c987abdebf2bee4b735cdb19088a
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeFilesize
29KB
MD5b84194140bccd00ffb365f3e2e268a37
SHA131c55d5d48f1d7dc253a3ce7a60eb05ec3228717
SHA2561510fee94e6464dce303cba141dfb8e97236a77b5ce474106664da8be63f4de7
SHA5126b599f6404cf3a8d7665daa0a9bf59a793dbb7536d30b35a89d38f3d345ba6ab9a5bc0e4b1b1b4cd4985416a7cc22dc5644e6183edd98b7309696b7f048cf22d
-
memory/4336-141-0x0000000000000000-mapping.dmp
-
memory/4716-138-0x0000000000000000-mapping.dmp
-
memory/4716-143-0x0000000074E20000-0x00000000753D1000-memory.dmpFilesize
5.7MB
-
memory/4716-144-0x0000000074E20000-0x00000000753D1000-memory.dmpFilesize
5.7MB
-
memory/4728-137-0x0000000074E20000-0x00000000753D1000-memory.dmpFilesize
5.7MB
-
memory/4728-134-0x0000000000000000-mapping.dmp
-
memory/4728-142-0x0000000074E20000-0x00000000753D1000-memory.dmpFilesize
5.7MB
-
memory/5092-132-0x0000000000000000-mapping.dmp