Analysis
-
max time kernel
179s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:40
Behavioral task
behavioral1
Sample
8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe
Resource
win7-20221111-en
General
-
Target
8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe
-
Size
29KB
-
MD5
dd3ff94e88a68a723445e3ddbce330e2
-
SHA1
766f72207fc755e28897dc4c5534b59efd4b80d7
-
SHA256
8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f
-
SHA512
d992e3fa02d0e2be12ed0715ae92a55418de510a75423c5a9d40c2cab9c2f3e85cfc3207bb7bc1d805b6265edcbf942ecac61fdff1ada9b246369a48183d74db
-
SSDEEP
768:0rD71oGc1FRVp74q8HesBKh0p29SgRde:WD71IPkpZKhG29jde
Malware Config
Extracted
njrat
0.6.4
HacKed
wesam2014.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 936 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exepid process 1672 8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Trojan.exepid process 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe 936 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 936 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exeTrojan.exedescription pid process target process PID 1672 wrote to memory of 936 1672 8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe Trojan.exe PID 1672 wrote to memory of 936 1672 8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe Trojan.exe PID 1672 wrote to memory of 936 1672 8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe Trojan.exe PID 1672 wrote to memory of 936 1672 8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe Trojan.exe PID 936 wrote to memory of 752 936 Trojan.exe netsh.exe PID 936 wrote to memory of 752 936 Trojan.exe netsh.exe PID 936 wrote to memory of 752 936 Trojan.exe netsh.exe PID 936 wrote to memory of 752 936 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe"C:\Users\Admin\AppData\Local\Temp\8fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5dd3ff94e88a68a723445e3ddbce330e2
SHA1766f72207fc755e28897dc4c5534b59efd4b80d7
SHA2568fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f
SHA512d992e3fa02d0e2be12ed0715ae92a55418de510a75423c5a9d40c2cab9c2f3e85cfc3207bb7bc1d805b6265edcbf942ecac61fdff1ada9b246369a48183d74db
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5dd3ff94e88a68a723445e3ddbce330e2
SHA1766f72207fc755e28897dc4c5534b59efd4b80d7
SHA2568fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f
SHA512d992e3fa02d0e2be12ed0715ae92a55418de510a75423c5a9d40c2cab9c2f3e85cfc3207bb7bc1d805b6265edcbf942ecac61fdff1ada9b246369a48183d74db
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5dd3ff94e88a68a723445e3ddbce330e2
SHA1766f72207fc755e28897dc4c5534b59efd4b80d7
SHA2568fe3efc9fa68a21e130159f668026f0c9588a08e09f09a2f330066e8fc84f07f
SHA512d992e3fa02d0e2be12ed0715ae92a55418de510a75423c5a9d40c2cab9c2f3e85cfc3207bb7bc1d805b6265edcbf942ecac61fdff1ada9b246369a48183d74db
-
memory/752-62-0x0000000000000000-mapping.dmp
-
memory/936-57-0x0000000000000000-mapping.dmp
-
memory/936-64-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/936-65-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/1672-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1672-55-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB
-
memory/1672-61-0x0000000074BB0000-0x000000007515B000-memory.dmpFilesize
5.7MB