Analysis
-
max time kernel
59s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 23:07
Static task
static1
Behavioral task
behavioral1
Sample
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe
Resource
win10v2004-20221111-en
General
-
Target
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe
-
Size
352KB
-
MD5
efde8f7c97f533dbb5f6b44412f7e0e8
-
SHA1
32b42444d368b4531dd5b196fb8413201b876f30
-
SHA256
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
-
SHA512
9a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
SSDEEP
3072:rnyCcI+02me4sZh7Bl/D8C6yi/5rwWZsRPEY9wcDkSFwVxjhC9qOf5Zad77cN/b:vvU7jUyeEmsWuTo5vsWd7pvOU7HJ7M5
Malware Config
Extracted
njrat
0.7d
w.w.w.w
ksa-ok.ddns.net:1177
3731b7c7eb0e242265ddcd1c2fa8c059
-
reg_key
3731b7c7eb0e242265ddcd1c2fa8c059
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
prosek.exeprosek.exepid process 664 prosek.exe 1868 prosek.exe -
Loads dropped DLL 3 IoCs
Processes:
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exeprosek.exepid process 1120 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 1120 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 664 prosek.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exeprosek.exedescription pid process target process PID 1724 set thread context of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 664 set thread context of 1868 664 prosek.exe prosek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exeprosek.exedescription pid process Token: SeDebugPrivilege 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe Token: SeDebugPrivilege 664 prosek.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exeprosek.exedescription pid process target process PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1724 wrote to memory of 1120 1724 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe PID 1120 wrote to memory of 664 1120 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe prosek.exe PID 1120 wrote to memory of 664 1120 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe prosek.exe PID 1120 wrote to memory of 664 1120 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe prosek.exe PID 1120 wrote to memory of 664 1120 8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe PID 664 wrote to memory of 1868 664 prosek.exe prosek.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe"C:\Users\Admin\AppData\Local\Temp\8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exeC:\Users\Admin\AppData\Local\Temp\8103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\prosek.exe"C:\Users\Admin\AppData\Local\Temp\prosek.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\prosek.exeC:\Users\Admin\AppData\Local\Temp\prosek.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\prosek.exeFilesize
352KB
MD5efde8f7c97f533dbb5f6b44412f7e0e8
SHA132b42444d368b4531dd5b196fb8413201b876f30
SHA2568103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
SHA5129a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
C:\Users\Admin\AppData\Local\Temp\prosek.exeFilesize
352KB
MD5efde8f7c97f533dbb5f6b44412f7e0e8
SHA132b42444d368b4531dd5b196fb8413201b876f30
SHA2568103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
SHA5129a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
C:\Users\Admin\AppData\Local\Temp\prosek.exeFilesize
352KB
MD5efde8f7c97f533dbb5f6b44412f7e0e8
SHA132b42444d368b4531dd5b196fb8413201b876f30
SHA2568103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
SHA5129a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
\Users\Admin\AppData\Local\Temp\prosek.exeFilesize
352KB
MD5efde8f7c97f533dbb5f6b44412f7e0e8
SHA132b42444d368b4531dd5b196fb8413201b876f30
SHA2568103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
SHA5129a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
\Users\Admin\AppData\Local\Temp\prosek.exeFilesize
352KB
MD5efde8f7c97f533dbb5f6b44412f7e0e8
SHA132b42444d368b4531dd5b196fb8413201b876f30
SHA2568103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
SHA5129a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
\Users\Admin\AppData\Local\Temp\prosek.exeFilesize
352KB
MD5efde8f7c97f533dbb5f6b44412f7e0e8
SHA132b42444d368b4531dd5b196fb8413201b876f30
SHA2568103f3aba4d0dca4899bacc85a3f716f52ea505263ad559fb51db32bcc6d3da7
SHA5129a6023d0f6d23c037c2a3bb296c328c12266a72b40d1bdf254bd901f1fe90157ff1678fcb8bee002e108a29986b05ecbc6431a1150c647decf2b57775b8747d6
-
memory/664-67-0x0000000000000000-mapping.dmp
-
memory/664-76-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/1120-64-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/1120-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1120-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1120-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1120-71-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/1120-63-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/1120-56-0x000000000040748E-mapping.dmp
-
memory/1724-54-0x0000000075531000-0x0000000075533000-memory.dmpFilesize
8KB
-
memory/1724-62-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/1868-74-0x000000000040748E-mapping.dmp