Analysis
-
max time kernel
203s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23/11/2022, 16:33
Behavioral task
behavioral1
Sample
الادبي.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
الادبي.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
العلمي.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
العلمي.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
كل العراق.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
كل العراق.exe
Resource
win10v2004-20221111-en
General
-
Target
العلمي.exe
-
Size
28KB
-
MD5
74526b46799abae6166733f30784d73b
-
SHA1
fc775da0774384e002314dd3b1e49f2c7dbd69d4
-
SHA256
e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205
-
SHA512
98d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27
-
SSDEEP
384:w9QXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzjm:wI7Js8oDSJz4wqZXenBKh0p29SgRl0
Malware Config
Extracted
njrat
0.6.4
HacKed
iraqiiraqi.no-ip.biz:99
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1508 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1936 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 2 IoCs
pid Process 1368 العلمي.exe 1368 العلمي.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe 1508 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1508 Trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1508 1368 العلمي.exe 28 PID 1368 wrote to memory of 1508 1368 العلمي.exe 28 PID 1368 wrote to memory of 1508 1368 العلمي.exe 28 PID 1368 wrote to memory of 1508 1368 العلمي.exe 28 PID 1508 wrote to memory of 1936 1508 Trojan.exe 29 PID 1508 wrote to memory of 1936 1508 Trojan.exe 29 PID 1508 wrote to memory of 1936 1508 Trojan.exe 29 PID 1508 wrote to memory of 1936 1508 Trojan.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\العلمي.exe"C:\Users\Admin\AppData\Local\Temp\العلمي.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1936
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD574526b46799abae6166733f30784d73b
SHA1fc775da0774384e002314dd3b1e49f2c7dbd69d4
SHA256e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205
SHA51298d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27
-
Filesize
28KB
MD574526b46799abae6166733f30784d73b
SHA1fc775da0774384e002314dd3b1e49f2c7dbd69d4
SHA256e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205
SHA51298d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27
-
Filesize
28KB
MD574526b46799abae6166733f30784d73b
SHA1fc775da0774384e002314dd3b1e49f2c7dbd69d4
SHA256e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205
SHA51298d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27
-
Filesize
28KB
MD574526b46799abae6166733f30784d73b
SHA1fc775da0774384e002314dd3b1e49f2c7dbd69d4
SHA256e935dcd2b982d3b46c39b880c812fbae4b9f73d5542a02839ef5ce48223f2205
SHA51298d5ea76b48ff8da220f8d2ec414894a09d30713a285b7f14861521d99c574918d4ac1df1b75af73fd5ec82681fd25832f83035833df1d822e902bae4a0dbe27