Analysis
-
max time kernel
36s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 20:43
Behavioral task
behavioral1
Sample
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe
Resource
win10v2004-20221111-en
General
-
Target
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe
-
Size
124KB
-
MD5
4bdec8b0a4462136e5bb4c96f34b1925
-
SHA1
dd768f480e0f9e1a0bc3820550ba17fe839f12a6
-
SHA256
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7
-
SHA512
ec31d50e8f782284b1da70d7069cc64be80249ab392e4854b7fce7cb815807c1c3d465b43a0903f3a2c4c8d784f7735499a0e71c43091a0888fb6c21b920d50c
-
SSDEEP
3072:g9IPsQA298MFVUmTAWjpypTLeC62zFtoqwzXt:gqj98M/UutILeczFtqt
Malware Config
Extracted
njrat
0.6.4
HacKed
bahamass1.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocaljMHWdtIuGT.exeTrojan.exepid process 1868 LocaljMHWdtIuGT.exe 1120 Trojan.exe -
Loads dropped DLL 1 IoCs
Processes:
LocaljMHWdtIuGT.exepid process 1868 LocaljMHWdtIuGT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exeLocaljMHWdtIuGT.exedescription pid process target process PID 1612 wrote to memory of 1868 1612 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 1612 wrote to memory of 1868 1612 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 1612 wrote to memory of 1868 1612 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 1612 wrote to memory of 1868 1612 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 1868 wrote to memory of 1120 1868 LocaljMHWdtIuGT.exe Trojan.exe PID 1868 wrote to memory of 1120 1868 LocaljMHWdtIuGT.exe Trojan.exe PID 1868 wrote to memory of 1120 1868 LocaljMHWdtIuGT.exe Trojan.exe PID 1868 wrote to memory of 1120 1868 LocaljMHWdtIuGT.exe Trojan.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe"C:\Users\Admin\AppData\Local\Temp\af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocaljMHWdtIuGT.exe"C:\Users\Admin\AppData\LocaljMHWdtIuGT.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
C:\Users\Admin\AppData\LocaljMHWdtIuGT.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
C:\Users\Admin\AppData\LocaljMHWdtIuGT.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
memory/1120-69-0x00000000747C0000-0x0000000074D6B000-memory.dmpFilesize
5.7MB
-
memory/1120-67-0x00000000747C0000-0x0000000074D6B000-memory.dmpFilesize
5.7MB
-
memory/1120-63-0x0000000000000000-mapping.dmp
-
memory/1612-55-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmpFilesize
8KB
-
memory/1612-54-0x000007FEF3A10000-0x000007FEF4433000-memory.dmpFilesize
10.1MB
-
memory/1612-59-0x000000001AD00000-0x000000001AD10000-memory.dmpFilesize
64KB
-
memory/1868-56-0x0000000000000000-mapping.dmp
-
memory/1868-61-0x00000000747C0000-0x0000000074D6B000-memory.dmpFilesize
5.7MB
-
memory/1868-68-0x00000000747C0000-0x0000000074D6B000-memory.dmpFilesize
5.7MB
-
memory/1868-60-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB