Analysis
-
max time kernel
160s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:58
Behavioral task
behavioral1
Sample
d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe
Resource
win10v2004-20220812-en
General
-
Target
d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe
-
Size
23KB
-
MD5
e339f0c2452f57c995640c9663e9c74b
-
SHA1
a1cca2b8789b2a287529f81126059254cb4c1053
-
SHA256
d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0
-
SHA512
89c1ee3f0edf5fd61ec4376411369d78cc18fa9e0c32dda26d002305ff616b9e454395c79c526abcb978b47348a7fa46ad4d4fbf0667c680d90efbf52ca59088
-
SSDEEP
384:XMK6b2GZsx/Yr1+liORH1kcPFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZiqN:wb9glF51LRpcnuNy
Malware Config
Extracted
njrat
0.7d
MRAKHAF
isuero.no-ip.info:1990
eded8ce0cce4bae66af70ac7c7464702
-
reg_key
eded8ce0cce4bae66af70ac7c7464702
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
prosesseur.exepid process 5076 prosesseur.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe -
Drops startup file 2 IoCs
Processes:
prosesseur.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eded8ce0cce4bae66af70ac7c7464702.exe prosesseur.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eded8ce0cce4bae66af70ac7c7464702.exe prosesseur.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
prosesseur.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eded8ce0cce4bae66af70ac7c7464702 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\prosesseur.exe\" .." prosesseur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eded8ce0cce4bae66af70ac7c7464702 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\prosesseur.exe\" .." prosesseur.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
prosesseur.exedescription pid process Token: SeDebugPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe Token: 33 5076 prosesseur.exe Token: SeIncBasePriorityPrivilege 5076 prosesseur.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exeprosesseur.exedescription pid process target process PID 2620 wrote to memory of 5076 2620 d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe prosesseur.exe PID 2620 wrote to memory of 5076 2620 d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe prosesseur.exe PID 2620 wrote to memory of 5076 2620 d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe prosesseur.exe PID 5076 wrote to memory of 4840 5076 prosesseur.exe netsh.exe PID 5076 wrote to memory of 4840 5076 prosesseur.exe netsh.exe PID 5076 wrote to memory of 4840 5076 prosesseur.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe"C:\Users\Admin\AppData\Local\Temp\d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\prosesseur.exe"C:\Users\Admin\AppData\Local\Temp\prosesseur.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\prosesseur.exe" "prosesseur.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\prosesseur.exeFilesize
23KB
MD5e339f0c2452f57c995640c9663e9c74b
SHA1a1cca2b8789b2a287529f81126059254cb4c1053
SHA256d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0
SHA51289c1ee3f0edf5fd61ec4376411369d78cc18fa9e0c32dda26d002305ff616b9e454395c79c526abcb978b47348a7fa46ad4d4fbf0667c680d90efbf52ca59088
-
C:\Users\Admin\AppData\Local\Temp\prosesseur.exeFilesize
23KB
MD5e339f0c2452f57c995640c9663e9c74b
SHA1a1cca2b8789b2a287529f81126059254cb4c1053
SHA256d89aac515eb7a4b5799be662c5e74e60e83b0bb09a75c367052973a9e43ec7c0
SHA51289c1ee3f0edf5fd61ec4376411369d78cc18fa9e0c32dda26d002305ff616b9e454395c79c526abcb978b47348a7fa46ad4d4fbf0667c680d90efbf52ca59088
-
memory/2620-132-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/2620-136-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/4840-138-0x0000000000000000-mapping.dmp
-
memory/5076-133-0x0000000000000000-mapping.dmp
-
memory/5076-137-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB
-
memory/5076-139-0x0000000074CA0000-0x0000000075251000-memory.dmpFilesize
5.7MB