Analysis
-
max time kernel
151s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:18
Behavioral task
behavioral1
Sample
c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe
Resource
win10v2004-20221111-en
General
-
Target
c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe
-
Size
29KB
-
MD5
37c960b09fd5281ea1d11e799d98d5f0
-
SHA1
a33c6a07b4c38e0bf9850b501fd578292fe9bfe0
-
SHA256
c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38
-
SHA512
21cdf8680b7eb9518fc58aa9d55452cd549edc08790964da843986ed260afdcbf296061dfa0eb8f0e83122269c8786a5aa02d319e878327174e92165b0c8b478
-
SSDEEP
768:xUi71MHaSf0gsHwqIXeyBKh0p29SgR5H:x71miQBjKhG29j5H
Malware Config
Extracted
njrat
0.6.4
صالح كوباني vpn
freepage.sytes.net:1999
d5a38e9b5f206c41f8851bf04a251d26
-
reg_key
d5a38e9b5f206c41f8851bf04a251d26
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 1236 chrome.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5a38e9b5f206c41f8851bf04a251d26.exe chrome.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d5a38e9b5f206c41f8851bf04a251d26.exe chrome.exe -
Loads dropped DLL 1 IoCs
Processes:
c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exepid process 1996 c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\d5a38e9b5f206c41f8851bf04a251d26 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome.exe\" .." chrome.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
chrome.exepid process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
chrome.exedescription pid process Token: SeDebugPrivilege 1236 chrome.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exechrome.exedescription pid process target process PID 1996 wrote to memory of 1236 1996 c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe chrome.exe PID 1996 wrote to memory of 1236 1996 c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe chrome.exe PID 1996 wrote to memory of 1236 1996 c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe chrome.exe PID 1996 wrote to memory of 1236 1996 c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe chrome.exe PID 1236 wrote to memory of 432 1236 chrome.exe netsh.exe PID 1236 wrote to memory of 432 1236 chrome.exe netsh.exe PID 1236 wrote to memory of 432 1236 chrome.exe netsh.exe PID 1236 wrote to memory of 432 1236 chrome.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe"C:\Users\Admin\AppData\Local\Temp\c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome.exe" "chrome.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD537c960b09fd5281ea1d11e799d98d5f0
SHA1a33c6a07b4c38e0bf9850b501fd578292fe9bfe0
SHA256c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38
SHA51221cdf8680b7eb9518fc58aa9d55452cd549edc08790964da843986ed260afdcbf296061dfa0eb8f0e83122269c8786a5aa02d319e878327174e92165b0c8b478
-
C:\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD537c960b09fd5281ea1d11e799d98d5f0
SHA1a33c6a07b4c38e0bf9850b501fd578292fe9bfe0
SHA256c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38
SHA51221cdf8680b7eb9518fc58aa9d55452cd549edc08790964da843986ed260afdcbf296061dfa0eb8f0e83122269c8786a5aa02d319e878327174e92165b0c8b478
-
\Users\Admin\AppData\Local\Temp\chrome.exeFilesize
29KB
MD537c960b09fd5281ea1d11e799d98d5f0
SHA1a33c6a07b4c38e0bf9850b501fd578292fe9bfe0
SHA256c9d944e5b381ba0475b88d52fa96b9d2690bbd3fa260aa24148625f024f2fc38
SHA51221cdf8680b7eb9518fc58aa9d55452cd549edc08790964da843986ed260afdcbf296061dfa0eb8f0e83122269c8786a5aa02d319e878327174e92165b0c8b478
-
memory/432-62-0x0000000000000000-mapping.dmp
-
memory/1236-57-0x0000000000000000-mapping.dmp
-
memory/1236-63-0x00000000745D0000-0x0000000074B7B000-memory.dmpFilesize
5.7MB
-
memory/1236-65-0x00000000745D0000-0x0000000074B7B000-memory.dmpFilesize
5.7MB
-
memory/1996-54-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1996-55-0x00000000745D0000-0x0000000074B7B000-memory.dmpFilesize
5.7MB
-
memory/1996-61-0x00000000745D0000-0x0000000074B7B000-memory.dmpFilesize
5.7MB