Analysis
-
max time kernel
163s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 18:27
Static task
static1
Behavioral task
behavioral1
Sample
8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe
Resource
win10v2004-20220812-en
General
-
Target
8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe
-
Size
66KB
-
MD5
24e2b06341682b01572efdf2799e86fd
-
SHA1
d88b5728b1a84087a23c75eccbbfb708fbb7ad46
-
SHA256
8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188
-
SHA512
56b2fd2e0963251cf2a3d108897ce3be0093c83f7dc4c04bc11bd3f8eb63a5edf253a305d93bc0bbabe6873f7a8a6dbd7546e7dd726daaf8722e2cace8e9cd52
-
SSDEEP
1536:89jRe4dIQeeO/2f58bariJW27s9ykGCK0Bw0eN:8re4G2h8bariJ5s3GCvyN
Malware Config
Extracted
njrat
0.6.4
HacKer
197.205.191.254:4561
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Encryptado.exeTrojan.exepid process 4264 Encryptado.exe 1868 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Encryptado.exe8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Encryptado.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
Trojan.exepid process 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe 1868 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 1868 Trojan.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exeEncryptado.exeTrojan.exedescription pid process target process PID 3032 wrote to memory of 4264 3032 8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe Encryptado.exe PID 3032 wrote to memory of 4264 3032 8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe Encryptado.exe PID 3032 wrote to memory of 4264 3032 8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe Encryptado.exe PID 4264 wrote to memory of 1868 4264 Encryptado.exe Trojan.exe PID 4264 wrote to memory of 1868 4264 Encryptado.exe Trojan.exe PID 4264 wrote to memory of 1868 4264 Encryptado.exe Trojan.exe PID 1868 wrote to memory of 1888 1868 Trojan.exe netsh.exe PID 1868 wrote to memory of 1888 1868 Trojan.exe netsh.exe PID 1868 wrote to memory of 1888 1868 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe"C:\Users\Admin\AppData\Local\Temp\8c5baa4c5b96c52ada699ce1eeb6e2da9df964a2ff19021879521f7de09a8188.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Encryptado.exe"C:\Users\Admin\AppData\Local\Temp\Encryptado.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Encryptado.exeFilesize
29KB
MD5f5ba2c294943a5465effad69b658073d
SHA1fad4279fc5e4adcad3d5749ade8961343d1139a1
SHA256b7dabd9ca29624dc6f0d7c3ce29b745345ee10bcf74548e7cf55fd6434140607
SHA512e2ad9aa623395f12c544aeac3c8cb93644dff3e28566937ae131a70470f64ff6ad2285237cb579e55b2fb29abbcabbe48840846d3c32396dfa2ecc69b7574394
-
C:\Users\Admin\AppData\Local\Temp\Encryptado.exeFilesize
29KB
MD5f5ba2c294943a5465effad69b658073d
SHA1fad4279fc5e4adcad3d5749ade8961343d1139a1
SHA256b7dabd9ca29624dc6f0d7c3ce29b745345ee10bcf74548e7cf55fd6434140607
SHA512e2ad9aa623395f12c544aeac3c8cb93644dff3e28566937ae131a70470f64ff6ad2285237cb579e55b2fb29abbcabbe48840846d3c32396dfa2ecc69b7574394
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5f5ba2c294943a5465effad69b658073d
SHA1fad4279fc5e4adcad3d5749ade8961343d1139a1
SHA256b7dabd9ca29624dc6f0d7c3ce29b745345ee10bcf74548e7cf55fd6434140607
SHA512e2ad9aa623395f12c544aeac3c8cb93644dff3e28566937ae131a70470f64ff6ad2285237cb579e55b2fb29abbcabbe48840846d3c32396dfa2ecc69b7574394
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5f5ba2c294943a5465effad69b658073d
SHA1fad4279fc5e4adcad3d5749ade8961343d1139a1
SHA256b7dabd9ca29624dc6f0d7c3ce29b745345ee10bcf74548e7cf55fd6434140607
SHA512e2ad9aa623395f12c544aeac3c8cb93644dff3e28566937ae131a70470f64ff6ad2285237cb579e55b2fb29abbcabbe48840846d3c32396dfa2ecc69b7574394
-
memory/1868-142-0x0000000000000000-mapping.dmp
-
memory/1868-148-0x000000006F590000-0x000000006FB41000-memory.dmpFilesize
5.7MB
-
memory/1868-147-0x000000006F590000-0x000000006FB41000-memory.dmpFilesize
5.7MB
-
memory/1888-146-0x0000000000000000-mapping.dmp
-
memory/3032-135-0x0000000004F90000-0x0000000005022000-memory.dmpFilesize
584KB
-
memory/3032-134-0x00000000054A0000-0x0000000005A44000-memory.dmpFilesize
5.6MB
-
memory/3032-133-0x0000000004DD0000-0x0000000004E6C000-memory.dmpFilesize
624KB
-
memory/3032-132-0x0000000000450000-0x0000000000462000-memory.dmpFilesize
72KB
-
memory/3032-136-0x0000000004EB0000-0x0000000004EBA000-memory.dmpFilesize
40KB
-
memory/3032-137-0x0000000005120000-0x0000000005176000-memory.dmpFilesize
344KB
-
memory/4264-141-0x000000006F590000-0x000000006FB41000-memory.dmpFilesize
5.7MB
-
memory/4264-145-0x000000006F590000-0x000000006FB41000-memory.dmpFilesize
5.7MB
-
memory/4264-138-0x0000000000000000-mapping.dmp