Analysis
-
max time kernel
175s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:48
Behavioral task
behavioral1
Sample
8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe
Resource
win10v2004-20221111-en
General
-
Target
8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe
-
Size
29KB
-
MD5
444ca0042e76c79b03e34d1a644ebb27
-
SHA1
9703cacaec1a4aeb7305f879eb41faef6e04c336
-
SHA256
8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e
-
SHA512
e3eb1beb39a1e491bf3355422f4507f7d65e536ad2c6ea03ac723e6cf61194def3e5bedda3c3828165b294eb92e0543865bf207fff8a9baf0978099ac4a11c9e
-
SSDEEP
384:A+jNl7fFhYUEWntB5Pc36WmqDoRE8e/aGBsbh0w4wlAokw9OhgOL1vYRGOZzPZY/:P77YUEkXy3Mqw7edBKh0p29SgR50
Malware Config
Extracted
njrat
0.6.4
HacKed
danamuhammad12.no-ip.org:1177
74d94d2bacd9d8a6b5e32bc0551a4a64
-
reg_key
74d94d2bacd9d8a6b5e32bc0551a4a64
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
No God But Allah.exepid process 1796 No God But Allah.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe -
Drops startup file 2 IoCs
Processes:
No God But Allah.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\74d94d2bacd9d8a6b5e32bc0551a4a64.exe No God But Allah.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\74d94d2bacd9d8a6b5e32bc0551a4a64.exe No God But Allah.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
No God But Allah.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\74d94d2bacd9d8a6b5e32bc0551a4a64 = "\"C:\\Users\\Admin\\AppData\\Roaming\\No God But Allah.exe\" .." No God But Allah.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\74d94d2bacd9d8a6b5e32bc0551a4a64 = "\"C:\\Users\\Admin\\AppData\\Roaming\\No God But Allah.exe\" .." No God But Allah.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
No God But Allah.exepid process 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe 1796 No God But Allah.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
No God But Allah.exedescription pid process Token: SeDebugPrivilege 1796 No God But Allah.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exeNo God But Allah.exedescription pid process target process PID 4296 wrote to memory of 1796 4296 8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe No God But Allah.exe PID 4296 wrote to memory of 1796 4296 8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe No God But Allah.exe PID 4296 wrote to memory of 1796 4296 8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe No God But Allah.exe PID 1796 wrote to memory of 1168 1796 No God But Allah.exe netsh.exe PID 1796 wrote to memory of 1168 1796 No God But Allah.exe netsh.exe PID 1796 wrote to memory of 1168 1796 No God But Allah.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe"C:\Users\Admin\AppData\Local\Temp\8499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Roaming\No God But Allah.exe"C:\Users\Admin\AppData\Roaming\No God But Allah.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\No God But Allah.exe" "No God But Allah.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1168
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5444ca0042e76c79b03e34d1a644ebb27
SHA19703cacaec1a4aeb7305f879eb41faef6e04c336
SHA2568499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e
SHA512e3eb1beb39a1e491bf3355422f4507f7d65e536ad2c6ea03ac723e6cf61194def3e5bedda3c3828165b294eb92e0543865bf207fff8a9baf0978099ac4a11c9e
-
Filesize
29KB
MD5444ca0042e76c79b03e34d1a644ebb27
SHA19703cacaec1a4aeb7305f879eb41faef6e04c336
SHA2568499fc86fd5a287da4f9cd0e555790750c57f6e34c1dca47e090e684f5409b1e
SHA512e3eb1beb39a1e491bf3355422f4507f7d65e536ad2c6ea03ac723e6cf61194def3e5bedda3c3828165b294eb92e0543865bf207fff8a9baf0978099ac4a11c9e