Analysis
-
max time kernel
315s -
max time network
332s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 03:02
Behavioral task
behavioral1
Sample
334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe
Resource
win10v2004-20221111-en
General
-
Target
334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe
-
Size
210KB
-
MD5
db54abe9cd4cf784164bffd2f72116d7
-
SHA1
b3dd3c0d0b4fcdbd10cddfd9787cc9dccfa45e46
-
SHA256
334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e
-
SHA512
365e59ace3bada5253b60ff155a4454ced9072096207efe7862bdd35933c3d9f0e40fcff354100b3bb8573693d39eadc5cfbe0332c92948e2bda865799161df7
-
SSDEEP
3072:nvssA29+e43idX6zbvOezG0z/3XKnkACUZuw7vi2cgK4Lt0Kpu6WA+NPjuTsUeQY:H9cikPO8+GL6MjUe6vATgk
Malware Config
Extracted
njrat
0.6.4
كرار هكر العراق
karar101.ddns.net:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Trojan.exepid process 4720 Trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Trojan.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exeTrojan.exedescription pid process target process PID 4692 wrote to memory of 4720 4692 334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe Trojan.exe PID 4692 wrote to memory of 4720 4692 334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe Trojan.exe PID 4692 wrote to memory of 4720 4692 334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe Trojan.exe PID 4720 wrote to memory of 332 4720 Trojan.exe netsh.exe PID 4720 wrote to memory of 332 4720 Trojan.exe netsh.exe PID 4720 wrote to memory of 332 4720 Trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe"C:\Users\Admin\AppData\Local\Temp\334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:332
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
210KB
MD5db54abe9cd4cf784164bffd2f72116d7
SHA1b3dd3c0d0b4fcdbd10cddfd9787cc9dccfa45e46
SHA256334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e
SHA512365e59ace3bada5253b60ff155a4454ced9072096207efe7862bdd35933c3d9f0e40fcff354100b3bb8573693d39eadc5cfbe0332c92948e2bda865799161df7
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exeFilesize
210KB
MD5db54abe9cd4cf784164bffd2f72116d7
SHA1b3dd3c0d0b4fcdbd10cddfd9787cc9dccfa45e46
SHA256334fe3b376bf10fac2a08efbd1bad31935e84612cae4e8bab6c33cfc2ac2cf1e
SHA512365e59ace3bada5253b60ff155a4454ced9072096207efe7862bdd35933c3d9f0e40fcff354100b3bb8573693d39eadc5cfbe0332c92948e2bda865799161df7
-
memory/332-139-0x0000000000000000-mapping.dmp
-
memory/4692-132-0x0000000075320000-0x00000000758D1000-memory.dmpFilesize
5.7MB
-
memory/4692-133-0x0000000075320000-0x00000000758D1000-memory.dmpFilesize
5.7MB
-
memory/4692-137-0x0000000075320000-0x00000000758D1000-memory.dmpFilesize
5.7MB
-
memory/4720-134-0x0000000000000000-mapping.dmp
-
memory/4720-138-0x0000000075320000-0x00000000758D1000-memory.dmpFilesize
5.7MB
-
memory/4720-140-0x0000000075320000-0x00000000758D1000-memory.dmpFilesize
5.7MB