Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 06:51
Behavioral task
behavioral1
Sample
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe
Resource
win10v2004-20220812-en
General
-
Target
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe
-
Size
23KB
-
MD5
9c2bf07e8852d4a499a19ae5f32d3b4c
-
SHA1
25ce7fe13d4b5483571aa8d04b8dc666d3f4e27f
-
SHA256
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88
-
SHA512
0f568a9ce888cdc48420cf41754fea7546a9719bcd1ccebc0be9b65a519abdaeac036f9a2f80268524c7466b47b2275b72fbd451c4c52155424274ff86ec1935
-
SSDEEP
384:/sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5D8mRvR6JZlbw8hqIusZzZyp:0f65K2Yf1jlRpcnuZ
Malware Config
Extracted
njrat
0.7d
HacKed
king-abci.no-ip.biz:1177
0a6b51b7951398ae59007347009ae860
-
reg_key
0a6b51b7951398ae59007347009ae860
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 4248 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe -
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0a6b51b7951398ae59007347009ae860.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0a6b51b7951398ae59007347009ae860.exe server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0a6b51b7951398ae59007347009ae860 = "\"C:\\Windows\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0a6b51b7951398ae59007347009ae860 = "\"C:\\Windows\\server.exe\" .." server.exe -
Drops file in Windows directory 1 IoCs
Processes:
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exedescription ioc process File created C:\Windows\server.exe ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe Token: 33 4248 server.exe Token: SeIncBasePriorityPrivilege 4248 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exeserver.exedescription pid process target process PID 4772 wrote to memory of 4248 4772 ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe server.exe PID 4772 wrote to memory of 4248 4772 ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe server.exe PID 4772 wrote to memory of 4248 4772 ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe server.exe PID 4248 wrote to memory of 1652 4248 server.exe netsh.exe PID 4248 wrote to memory of 1652 4248 server.exe netsh.exe PID 4248 wrote to memory of 1652 4248 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe"C:\Users\Admin\AppData\Local\Temp\ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\server.exe"C:\Windows\server.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\server.exeFilesize
23KB
MD59c2bf07e8852d4a499a19ae5f32d3b4c
SHA125ce7fe13d4b5483571aa8d04b8dc666d3f4e27f
SHA256ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88
SHA5120f568a9ce888cdc48420cf41754fea7546a9719bcd1ccebc0be9b65a519abdaeac036f9a2f80268524c7466b47b2275b72fbd451c4c52155424274ff86ec1935
-
C:\Windows\server.exeFilesize
23KB
MD59c2bf07e8852d4a499a19ae5f32d3b4c
SHA125ce7fe13d4b5483571aa8d04b8dc666d3f4e27f
SHA256ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88
SHA5120f568a9ce888cdc48420cf41754fea7546a9719bcd1ccebc0be9b65a519abdaeac036f9a2f80268524c7466b47b2275b72fbd451c4c52155424274ff86ec1935
-
memory/1652-139-0x0000000000000000-mapping.dmp
-
memory/4248-134-0x0000000000000000-mapping.dmp
-
memory/4248-138-0x00000000747E0000-0x0000000074D91000-memory.dmpFilesize
5.7MB
-
memory/4248-140-0x00000000747E0000-0x0000000074D91000-memory.dmpFilesize
5.7MB
-
memory/4772-132-0x00000000747E0000-0x0000000074D91000-memory.dmpFilesize
5.7MB
-
memory/4772-133-0x00000000747E0000-0x0000000074D91000-memory.dmpFilesize
5.7MB
-
memory/4772-137-0x00000000747E0000-0x0000000074D91000-memory.dmpFilesize
5.7MB