Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 02:14
Static task
static1
Behavioral task
behavioral1
Sample
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe
Resource
win10v2004-20221111-en
General
-
Target
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe
-
Size
160KB
-
MD5
9fe7379c8a0a17a30599135aa45de063
-
SHA1
ad281660a1d5f129270df4b75dcf493d5a15dcc1
-
SHA256
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
-
SHA512
186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
SSDEEP
3072:f5PvaDd6GrJZe4X7jHsvfIN+1Vh/UtVmiljWMzrZI6vKi0JEswBb4kAlmVs4Jo0x:f0PsX1Fu8iLn
Malware Config
Extracted
njrat
0.7d
HacKed
masterhaxor786.no-ip.biz:2266
3aa149aec61c967d02e94eaa12efb196
-
reg_key
3aa149aec61c967d02e94eaa12efb196
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
server.exeserver.exepid process 1212 server.exe 2044 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
Processes:
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exeserver.exepid process 908 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 908 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 1212 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\3aa149aec61c967d02e94eaa12efb196 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\3aa149aec61c967d02e94eaa12efb196 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exeserver.exedescription pid process target process PID 1960 set thread context of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1212 set thread context of 2044 1212 server.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exeserver.exeserver.exedescription pid process Token: SeDebugPrivilege 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe Token: SeDebugPrivilege 1212 server.exe Token: SeDebugPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe Token: 33 2044 server.exe Token: SeIncBasePriorityPrivilege 2044 server.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exeserver.exeserver.exedescription pid process target process PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 1960 wrote to memory of 908 1960 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe PID 908 wrote to memory of 1212 908 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe server.exe PID 908 wrote to memory of 1212 908 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe server.exe PID 908 wrote to memory of 1212 908 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe server.exe PID 908 wrote to memory of 1212 908 9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 1212 wrote to memory of 2044 1212 server.exe server.exe PID 2044 wrote to memory of 1660 2044 server.exe netsh.exe PID 2044 wrote to memory of 1660 2044 server.exe netsh.exe PID 2044 wrote to memory of 1660 2044 server.exe netsh.exe PID 2044 wrote to memory of 1660 2044 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe"C:\Users\Admin\AppData\Local\Temp\9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe"C:\Users\Admin\AppData\Local\Temp\9db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
160KB
MD59fe7379c8a0a17a30599135aa45de063
SHA1ad281660a1d5f129270df4b75dcf493d5a15dcc1
SHA2569db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
SHA512186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
160KB
MD59fe7379c8a0a17a30599135aa45de063
SHA1ad281660a1d5f129270df4b75dcf493d5a15dcc1
SHA2569db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
SHA512186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
160KB
MD59fe7379c8a0a17a30599135aa45de063
SHA1ad281660a1d5f129270df4b75dcf493d5a15dcc1
SHA2569db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
SHA512186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
160KB
MD59fe7379c8a0a17a30599135aa45de063
SHA1ad281660a1d5f129270df4b75dcf493d5a15dcc1
SHA2569db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
SHA512186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
160KB
MD59fe7379c8a0a17a30599135aa45de063
SHA1ad281660a1d5f129270df4b75dcf493d5a15dcc1
SHA2569db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
SHA512186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
160KB
MD59fe7379c8a0a17a30599135aa45de063
SHA1ad281660a1d5f129270df4b75dcf493d5a15dcc1
SHA2569db196d8a6e32e728dbf851f2eeccce0dc7ccff6219ab76ade9b9fe7e2a2398a
SHA512186a90132873c4dce99156b0ce456b2ea78989a2eeb7c33adc9caf7f2c0dbc246bfcbb31436878a96222217f41f88d2a59445cc33617d202b14f0453eb371262
-
memory/908-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/908-65-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/908-56-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/908-61-0x000000000040748E-mapping.dmp
-
memory/908-55-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/908-59-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/908-78-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/908-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/908-68-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/908-63-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1212-86-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/1212-71-0x0000000000000000-mapping.dmp
-
memory/1660-92-0x0000000000000000-mapping.dmp
-
memory/1960-54-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1960-67-0x0000000074690000-0x0000000074C3B000-memory.dmpFilesize
5.7MB
-
memory/2044-94-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB
-
memory/2044-83-0x000000000040748E-mapping.dmp
-
memory/2044-91-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB