Analysis
-
max time kernel
155s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 23:23
Static task
static1
Behavioral task
behavioral1
Sample
7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe
Resource
win10v2004-20220901-en
General
-
Target
7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe
-
Size
104KB
-
MD5
28a7d4e2b5f033f4f33791f32c6e9fad
-
SHA1
c14648e59b09f70800e94b715a82a0a1c9022973
-
SHA256
7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7
-
SHA512
a6ca99a32132ce326131f22176b8aba0a2c2a2801c3db301c64a5f6ec1f4f456a4d2cdd89b7c0bc4b4c96ca9c313c15777f6aed12d719f1482c0009e7c5960fd
-
SSDEEP
1536:hS06taZRfWxSdh3Hm/ukxj6CB4Y/2ugu39o4loYFusUuoub5IgRefP:n6taqxq3H326CB3NoRsUuo45fg
Malware Config
Extracted
njrat
0.6.4
HacKed
127.0.0.1:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Server.exeTrojan.exepid process 544 Server.exe 668 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Trojan.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Loads dropped DLL 1 IoCs
Processes:
Server.exepid process 544 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Trojan.exepid process 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe 668 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 668 Trojan.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exeServer.exeTrojan.exedescription pid process target process PID 1780 wrote to memory of 544 1780 7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe Server.exe PID 1780 wrote to memory of 544 1780 7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe Server.exe PID 1780 wrote to memory of 544 1780 7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe Server.exe PID 1780 wrote to memory of 544 1780 7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe Server.exe PID 544 wrote to memory of 668 544 Server.exe Trojan.exe PID 544 wrote to memory of 668 544 Server.exe Trojan.exe PID 544 wrote to memory of 668 544 Server.exe Trojan.exe PID 544 wrote to memory of 668 544 Server.exe Trojan.exe PID 668 wrote to memory of 1880 668 Trojan.exe netsh.exe PID 668 wrote to memory of 1880 668 Trojan.exe netsh.exe PID 668 wrote to memory of 1880 668 Trojan.exe netsh.exe PID 668 wrote to memory of 1880 668 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe"C:\Users\Admin\AppData\Local\Temp\7b7c288ca4735bd9056751ec9a307899ebe864418446fd23396666297cee3dd7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
29KB
MD56038246d0492fcf0275c06b43075d9d6
SHA12da6464727459c6c7ba651da9b31a6e3304e39a2
SHA2566069f85e13b215117867e4aadf684547f133498a3bca5c980af9df82ab3507e1
SHA512eef8a49ff0cf9b8aad150c1bfc82ea9b2688bf51400a0392edd683d6a864e96b6496bce5e8ebbe75880999b1f91c21682371989ed6d22a4de3fb82c901a9b218
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
29KB
MD56038246d0492fcf0275c06b43075d9d6
SHA12da6464727459c6c7ba651da9b31a6e3304e39a2
SHA2566069f85e13b215117867e4aadf684547f133498a3bca5c980af9df82ab3507e1
SHA512eef8a49ff0cf9b8aad150c1bfc82ea9b2688bf51400a0392edd683d6a864e96b6496bce5e8ebbe75880999b1f91c21682371989ed6d22a4de3fb82c901a9b218
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD56038246d0492fcf0275c06b43075d9d6
SHA12da6464727459c6c7ba651da9b31a6e3304e39a2
SHA2566069f85e13b215117867e4aadf684547f133498a3bca5c980af9df82ab3507e1
SHA512eef8a49ff0cf9b8aad150c1bfc82ea9b2688bf51400a0392edd683d6a864e96b6496bce5e8ebbe75880999b1f91c21682371989ed6d22a4de3fb82c901a9b218
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD56038246d0492fcf0275c06b43075d9d6
SHA12da6464727459c6c7ba651da9b31a6e3304e39a2
SHA2566069f85e13b215117867e4aadf684547f133498a3bca5c980af9df82ab3507e1
SHA512eef8a49ff0cf9b8aad150c1bfc82ea9b2688bf51400a0392edd683d6a864e96b6496bce5e8ebbe75880999b1f91c21682371989ed6d22a4de3fb82c901a9b218
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD56038246d0492fcf0275c06b43075d9d6
SHA12da6464727459c6c7ba651da9b31a6e3304e39a2
SHA2566069f85e13b215117867e4aadf684547f133498a3bca5c980af9df82ab3507e1
SHA512eef8a49ff0cf9b8aad150c1bfc82ea9b2688bf51400a0392edd683d6a864e96b6496bce5e8ebbe75880999b1f91c21682371989ed6d22a4de3fb82c901a9b218
-
memory/544-57-0x0000000000000000-mapping.dmp
-
memory/544-60-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/544-61-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/544-67-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/668-63-0x0000000000000000-mapping.dmp
-
memory/668-68-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/668-71-0x0000000073EB0000-0x000000007445B000-memory.dmpFilesize
5.7MB
-
memory/1780-56-0x0000000000DC0000-0x0000000000DD0000-memory.dmpFilesize
64KB
-
memory/1780-55-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmpFilesize
8KB
-
memory/1780-54-0x000007FEF35B0000-0x000007FEF3FD3000-memory.dmpFilesize
10.1MB
-
memory/1880-69-0x0000000000000000-mapping.dmp