Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:49
Behavioral task
behavioral1
Sample
fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe
Resource
win10v2004-20220812-en
General
-
Target
fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe
-
Size
23KB
-
MD5
a32d346ae5b16d68c82eb24e72e85e22
-
SHA1
4ba8b1561e615636a88e4157f9f2bf53070326d4
-
SHA256
fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41
-
SHA512
22b79858a6e498a0d46ea425b9d94ab0eec078e44cfdd953fd8c33112627e0b0373ec4dbc60fe2aace21b0f31044586491a058029ecbf7d9a6a4156777da3a4c
-
SSDEEP
384:y8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZ7G:sY+sNKqNHnSdRpcnu9
Malware Config
Extracted
njrat
0.7d
HacKed
hackeriq.ddns.net:5552
63286a81c3a7dd3c6bb20ef63307f18e
-
reg_key
63286a81c3a7dd3c6bb20ef63307f18e
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 2252 chrome.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe -
Drops startup file 2 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63286a81c3a7dd3c6bb20ef63307f18e.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63286a81c3a7dd3c6bb20ef63307f18e.exe chrome.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\63286a81c3a7dd3c6bb20ef63307f18e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\63286a81c3a7dd3c6bb20ef63307f18e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe Token: 33 2252 chrome.exe Token: SeIncBasePriorityPrivilege 2252 chrome.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exechrome.exedescription pid process target process PID 4616 wrote to memory of 2252 4616 fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe chrome.exe PID 4616 wrote to memory of 2252 4616 fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe chrome.exe PID 4616 wrote to memory of 2252 4616 fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe chrome.exe PID 2252 wrote to memory of 3296 2252 chrome.exe netsh.exe PID 2252 wrote to memory of 3296 2252 chrome.exe netsh.exe PID 2252 wrote to memory of 3296 2252 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe"C:\Users\Admin\AppData\Local\Temp\fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
23KB
MD5a32d346ae5b16d68c82eb24e72e85e22
SHA14ba8b1561e615636a88e4157f9f2bf53070326d4
SHA256fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41
SHA51222b79858a6e498a0d46ea425b9d94ab0eec078e44cfdd953fd8c33112627e0b0373ec4dbc60fe2aace21b0f31044586491a058029ecbf7d9a6a4156777da3a4c
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
23KB
MD5a32d346ae5b16d68c82eb24e72e85e22
SHA14ba8b1561e615636a88e4157f9f2bf53070326d4
SHA256fb93d71a2b8201e25f97a80dc9efe9ca2621098a65f6bdf1124cd112682e6a41
SHA51222b79858a6e498a0d46ea425b9d94ab0eec078e44cfdd953fd8c33112627e0b0373ec4dbc60fe2aace21b0f31044586491a058029ecbf7d9a6a4156777da3a4c
-
memory/2252-133-0x0000000000000000-mapping.dmp
-
memory/2252-137-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/2252-139-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/3296-138-0x0000000000000000-mapping.dmp
-
memory/4616-132-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB
-
memory/4616-136-0x0000000074ED0000-0x0000000075481000-memory.dmpFilesize
5.7MB