Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:49
Behavioral task
behavioral1
Sample
6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe
Resource
win10v2004-20220901-en
General
-
Target
6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe
-
Size
180KB
-
MD5
0a5c7a351889c0416f63ddc78a731e56
-
SHA1
40a628f39e9e6d5f4f3714fc62b8524941c1e993
-
SHA256
6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f
-
SHA512
64092a18df6d47dd62504978d2c4e619627652aac887422886a7c95bf424384dc7ae6949f5c83a9419bdb5dfe0b3d347f2ca64bccf8b88802d767f2b65c4a346
-
SSDEEP
3072:RvC2jbA29f/zgoX+UNFMX1K9hLKCGb1KzdMVdhx+QPLTZypUBmbCDktybizJ:f39nzgsFIK9hZGbeMVlj4UBmbCAtgil
Malware Config
Extracted
njrat
0.6.4
HacKed
rivax01.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocalZDmQSCOCZ_.exeTrojan.exepid process 1644 LocalZDmQSCOCZ_.exe 64 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exeLocalZDmQSCOCZ_.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation LocalZDmQSCOCZ_.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
Trojan.exepid process 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe 64 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 64 Trojan.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exeLocalZDmQSCOCZ_.exeTrojan.exedescription pid process target process PID 2312 wrote to memory of 1644 2312 6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe LocalZDmQSCOCZ_.exe PID 2312 wrote to memory of 1644 2312 6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe LocalZDmQSCOCZ_.exe PID 2312 wrote to memory of 1644 2312 6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe LocalZDmQSCOCZ_.exe PID 1644 wrote to memory of 64 1644 LocalZDmQSCOCZ_.exe Trojan.exe PID 1644 wrote to memory of 64 1644 LocalZDmQSCOCZ_.exe Trojan.exe PID 1644 wrote to memory of 64 1644 LocalZDmQSCOCZ_.exe Trojan.exe PID 64 wrote to memory of 4512 64 Trojan.exe netsh.exe PID 64 wrote to memory of 4512 64 Trojan.exe netsh.exe PID 64 wrote to memory of 4512 64 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe"C:\Users\Admin\AppData\Local\Temp\6aa69657b903959b5abdc42744653513d6152dd0164e31b8c4aaa2136ced5b5f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocalZDmQSCOCZ_.exe"C:\Users\Admin\AppData\LocalZDmQSCOCZ_.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalZDmQSCOCZ_.exeFilesize
29KB
MD5da76e9feb76ae6647b9715195830c6e6
SHA1895d1ea81ec7b0cb3faf9d9f51fa838261bcff13
SHA2563a184fe74f729b31740fe5cc67bb8f9338b205430c1f77b521b35d4d61f9b127
SHA512a54b22f8c44254e1ce9d53ddf4cae41d3162c92974702fca250c6faa8d351e3dccd2e4a7ef034e964bbad9ecdd489100a6bf8b1d060cb2994aad21425000f97b
-
C:\Users\Admin\AppData\LocalZDmQSCOCZ_.exeFilesize
29KB
MD5da76e9feb76ae6647b9715195830c6e6
SHA1895d1ea81ec7b0cb3faf9d9f51fa838261bcff13
SHA2563a184fe74f729b31740fe5cc67bb8f9338b205430c1f77b521b35d4d61f9b127
SHA512a54b22f8c44254e1ce9d53ddf4cae41d3162c92974702fca250c6faa8d351e3dccd2e4a7ef034e964bbad9ecdd489100a6bf8b1d060cb2994aad21425000f97b
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5da76e9feb76ae6647b9715195830c6e6
SHA1895d1ea81ec7b0cb3faf9d9f51fa838261bcff13
SHA2563a184fe74f729b31740fe5cc67bb8f9338b205430c1f77b521b35d4d61f9b127
SHA512a54b22f8c44254e1ce9d53ddf4cae41d3162c92974702fca250c6faa8d351e3dccd2e4a7ef034e964bbad9ecdd489100a6bf8b1d060cb2994aad21425000f97b
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD5da76e9feb76ae6647b9715195830c6e6
SHA1895d1ea81ec7b0cb3faf9d9f51fa838261bcff13
SHA2563a184fe74f729b31740fe5cc67bb8f9338b205430c1f77b521b35d4d61f9b127
SHA512a54b22f8c44254e1ce9d53ddf4cae41d3162c92974702fca250c6faa8d351e3dccd2e4a7ef034e964bbad9ecdd489100a6bf8b1d060cb2994aad21425000f97b
-
memory/64-137-0x0000000000000000-mapping.dmp
-
memory/64-142-0x00000000753A0000-0x0000000075951000-memory.dmpFilesize
5.7MB
-
memory/64-143-0x00000000753A0000-0x0000000075951000-memory.dmpFilesize
5.7MB
-
memory/1644-133-0x0000000000000000-mapping.dmp
-
memory/1644-136-0x00000000753A0000-0x0000000075951000-memory.dmpFilesize
5.7MB
-
memory/1644-140-0x00000000753A0000-0x0000000075951000-memory.dmpFilesize
5.7MB
-
memory/2312-132-0x00007FFA529A0000-0x00007FFA533D6000-memory.dmpFilesize
10.2MB
-
memory/4512-141-0x0000000000000000-mapping.dmp