Analysis
-
max time kernel
189s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 14:40
Behavioral task
behavioral1
Sample
3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe
Resource
win10v2004-20221111-en
General
-
Target
3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe
-
Size
182KB
-
MD5
c413ef6a9921f37a7766c736c02958a2
-
SHA1
a20883218ee4067ed97e762b4f1d693ce0e9c927
-
SHA256
3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2
-
SHA512
dadf781ecb5513f6b3d79fa14f4bfeace823e90ad8920e8b8f3d795334e272a929f18becabb7c6c88b7e2ff1f1212f2031c306edadc3ebeec960e5cbe627bad4
-
SSDEEP
1536:FvZiUkdJRWuBIu/R1jn9+OhU0D+1RamKcqkPAtk7jKyKPNjiD/FbprdIBS22bfUz:FhiUOJ0GjoO+0bm5rey2OdIBJiw
Malware Config
Extracted
njrat
0.7d
HacKed
mahamadhawrami11.ddns.net:1177
3c85567a562aef333ed82feac3a2b02e
-
reg_key
3c85567a562aef333ed82feac3a2b02e
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
internetfree.exepid process 992 internetfree.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe -
Drops startup file 2 IoCs
Processes:
internetfree.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3c85567a562aef333ed82feac3a2b02e.exe internetfree.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3c85567a562aef333ed82feac3a2b02e.exe internetfree.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
internetfree.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3c85567a562aef333ed82feac3a2b02e = "\"C:\\Users\\Admin\\AppData\\Roaming\\internetfree.exe\" .." internetfree.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3c85567a562aef333ed82feac3a2b02e = "\"C:\\Users\\Admin\\AppData\\Roaming\\internetfree.exe\" .." internetfree.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
internetfree.exedescription pid process Token: SeDebugPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe Token: 33 992 internetfree.exe Token: SeIncBasePriorityPrivilege 992 internetfree.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exeinternetfree.exedescription pid process target process PID 4464 wrote to memory of 992 4464 3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe internetfree.exe PID 4464 wrote to memory of 992 4464 3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe internetfree.exe PID 4464 wrote to memory of 992 4464 3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe internetfree.exe PID 992 wrote to memory of 2880 992 internetfree.exe netsh.exe PID 992 wrote to memory of 2880 992 internetfree.exe netsh.exe PID 992 wrote to memory of 2880 992 internetfree.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe"C:\Users\Admin\AppData\Local\Temp\3016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\internetfree.exe"C:\Users\Admin\AppData\Roaming\internetfree.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\internetfree.exe" "internetfree.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\internetfree.exeFilesize
182KB
MD5c413ef6a9921f37a7766c736c02958a2
SHA1a20883218ee4067ed97e762b4f1d693ce0e9c927
SHA2563016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2
SHA512dadf781ecb5513f6b3d79fa14f4bfeace823e90ad8920e8b8f3d795334e272a929f18becabb7c6c88b7e2ff1f1212f2031c306edadc3ebeec960e5cbe627bad4
-
C:\Users\Admin\AppData\Roaming\internetfree.exeFilesize
182KB
MD5c413ef6a9921f37a7766c736c02958a2
SHA1a20883218ee4067ed97e762b4f1d693ce0e9c927
SHA2563016b73d983f1d79e2f66e15384558829ed16447b17b15236a15f02b9e461ff2
SHA512dadf781ecb5513f6b3d79fa14f4bfeace823e90ad8920e8b8f3d795334e272a929f18becabb7c6c88b7e2ff1f1212f2031c306edadc3ebeec960e5cbe627bad4
-
memory/992-134-0x0000000000000000-mapping.dmp
-
memory/992-137-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/992-139-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/2880-140-0x0000000000000000-mapping.dmp
-
memory/4464-132-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/4464-133-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB
-
memory/4464-138-0x0000000074E50000-0x0000000075401000-memory.dmpFilesize
5.7MB