Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 20:43
Behavioral task
behavioral1
Sample
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe
Resource
win10v2004-20221111-en
General
-
Target
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe
-
Size
124KB
-
MD5
4bdec8b0a4462136e5bb4c96f34b1925
-
SHA1
dd768f480e0f9e1a0bc3820550ba17fe839f12a6
-
SHA256
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7
-
SHA512
ec31d50e8f782284b1da70d7069cc64be80249ab392e4854b7fce7cb815807c1c3d465b43a0903f3a2c4c8d784f7735499a0e71c43091a0888fb6c21b920d50c
-
SSDEEP
3072:g9IPsQA298MFVUmTAWjpypTLeC62zFtoqwzXt:gqj98M/UutILeczFtqt
Malware Config
Extracted
njrat
0.6.4
HacKed
bahamass1.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
LocaljMHWdtIuGT.exeTrojan.exepid process 2144 LocaljMHWdtIuGT.exe 2548 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exeLocaljMHWdtIuGT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation LocaljMHWdtIuGT.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Trojan.exepid process 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe 2548 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 2548 Trojan.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exeLocaljMHWdtIuGT.exeTrojan.exedescription pid process target process PID 4276 wrote to memory of 2144 4276 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 4276 wrote to memory of 2144 4276 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 4276 wrote to memory of 2144 4276 af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe LocaljMHWdtIuGT.exe PID 2144 wrote to memory of 2548 2144 LocaljMHWdtIuGT.exe Trojan.exe PID 2144 wrote to memory of 2548 2144 LocaljMHWdtIuGT.exe Trojan.exe PID 2144 wrote to memory of 2548 2144 LocaljMHWdtIuGT.exe Trojan.exe PID 2548 wrote to memory of 1812 2548 Trojan.exe netsh.exe PID 2548 wrote to memory of 1812 2548 Trojan.exe netsh.exe PID 2548 wrote to memory of 1812 2548 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe"C:\Users\Admin\AppData\Local\Temp\af9fdc6ca4c2d6b9755399c8da47ca9223c9c0c17edb4ba370314cb71f9dffe7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\LocaljMHWdtIuGT.exe"C:\Users\Admin\AppData\LocaljMHWdtIuGT.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
C:\Users\Admin\AppData\LocaljMHWdtIuGT.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
C:\Users\Admin\AppData\LocaljMHWdtIuGT.exeFilesize
29KB
MD55c58b358faa10045400eef194b91d97c
SHA125ef5001c34b5f5e9491d0640de3d2f85fb32cc3
SHA25684f48352983ecc923c7b3884a38a2674efb2538cddb3aff9037eae30f276cdd6
SHA5128e98be87606cfb03714455e71d68f2fb19c1d5bec19254c841c97f5f124f9cddcb852c8d03ec4844e12284b7d5372732bd52fe02f1978f86e67286b877fc53be
-
memory/1812-141-0x0000000000000000-mapping.dmp
-
memory/2144-133-0x0000000000000000-mapping.dmp
-
memory/2144-136-0x0000000075410000-0x00000000759C1000-memory.dmpFilesize
5.7MB
-
memory/2144-140-0x0000000075410000-0x00000000759C1000-memory.dmpFilesize
5.7MB
-
memory/2548-137-0x0000000000000000-mapping.dmp
-
memory/2548-142-0x0000000075410000-0x00000000759C1000-memory.dmpFilesize
5.7MB
-
memory/2548-143-0x0000000075410000-0x00000000759C1000-memory.dmpFilesize
5.7MB
-
memory/4276-132-0x000000001BB70000-0x000000001C5A6000-memory.dmpFilesize
10.2MB