Analysis
-
max time kernel
151s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 23:39
Behavioral task
behavioral1
Sample
9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe
Resource
win7-20220901-en
General
-
Target
9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe
-
Size
23KB
-
MD5
42d1b2dfdf83b0f1e5e257072a51108b
-
SHA1
981a6ec09bc61778025a4a654c0f161b1255ff40
-
SHA256
9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1
-
SHA512
908446fddfebfa655b443562048027500f26c2a9c046b5b13c4a3689885808d1d3b54fce30a35db86bc87996af8cba2ad8599b2c2b51bb87e825ece2df1e30e7
-
SSDEEP
384:G+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZcozEu:5m+71d5XRpcnu2D
Malware Config
Extracted
njrat
0.7d
hacker
mrcod.publicvm.com:1177
0b0829e06d028299289e683c2462e806
-
reg_key
0b0829e06d028299289e683c2462e806
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 2192 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
Trojan.exedescription pid process Token: SeDebugPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe Token: 33 2192 Trojan.exe Token: SeIncBasePriorityPrivilege 2192 Trojan.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exeTrojan.exedescription pid process target process PID 1464 wrote to memory of 2192 1464 9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe Trojan.exe PID 1464 wrote to memory of 2192 1464 9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe Trojan.exe PID 1464 wrote to memory of 2192 1464 9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe Trojan.exe PID 2192 wrote to memory of 4728 2192 Trojan.exe netsh.exe PID 2192 wrote to memory of 4728 2192 Trojan.exe netsh.exe PID 2192 wrote to memory of 4728 2192 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe"C:\Users\Admin\AppData\Local\Temp\9f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
23KB
MD542d1b2dfdf83b0f1e5e257072a51108b
SHA1981a6ec09bc61778025a4a654c0f161b1255ff40
SHA2569f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1
SHA512908446fddfebfa655b443562048027500f26c2a9c046b5b13c4a3689885808d1d3b54fce30a35db86bc87996af8cba2ad8599b2c2b51bb87e825ece2df1e30e7
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
23KB
MD542d1b2dfdf83b0f1e5e257072a51108b
SHA1981a6ec09bc61778025a4a654c0f161b1255ff40
SHA2569f42320dfbf5defbe21455ef824e711a5e603703631d9f1669abe8b6d54fcdf1
SHA512908446fddfebfa655b443562048027500f26c2a9c046b5b13c4a3689885808d1d3b54fce30a35db86bc87996af8cba2ad8599b2c2b51bb87e825ece2df1e30e7
-
memory/1464-132-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/1464-133-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/1464-137-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/2192-134-0x0000000000000000-mapping.dmp
-
memory/2192-138-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/2192-140-0x00000000748F0000-0x0000000074EA1000-memory.dmpFilesize
5.7MB
-
memory/4728-139-0x0000000000000000-mapping.dmp