Analysis
-
max time kernel
187s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 06:53
Behavioral task
behavioral1
Sample
e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe
Resource
win10v2004-20220812-en
General
-
Target
e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe
-
Size
163KB
-
MD5
baf33f6fa9571bd34abe6c5afde6768d
-
SHA1
0ce0c82e67151840d385819820673c382804cba9
-
SHA256
e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306
-
SHA512
bfcc27c47861ba491f0ac9504e6b96aa9bb30f6e45652d3840ae96830d9d29bec17e9b7ac17fc31c0ab04046dfd81c71d40376fbc8004307184bdf77b5d1f5f2
-
SSDEEP
3072:qcwb0Xp27xCh92rg56gGiDbV2/W36eyjiu8iW:7AAh1DbV2/W36eyuu8N
Malware Config
Extracted
njrat
0.7d
HacKed
alpha-7.no-ip.biz:5552
f3b4549e9273b6cf9b3f02a2ce32bfa0
-
reg_key
f3b4549e9273b6cf9b3f02a2ce32bfa0
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
game.exepid process 4608 game.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe -
Drops startup file 2 IoCs
Processes:
game.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f3b4549e9273b6cf9b3f02a2ce32bfa0.exe game.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f3b4549e9273b6cf9b3f02a2ce32bfa0.exe game.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
game.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f3b4549e9273b6cf9b3f02a2ce32bfa0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\game.exe\" .." game.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\f3b4549e9273b6cf9b3f02a2ce32bfa0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\game.exe\" .." game.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
game.exedescription pid process Token: SeDebugPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe Token: 33 4608 game.exe Token: SeIncBasePriorityPrivilege 4608 game.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exegame.exedescription pid process target process PID 5088 wrote to memory of 4608 5088 e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe game.exe PID 5088 wrote to memory of 4608 5088 e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe game.exe PID 5088 wrote to memory of 4608 5088 e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe game.exe PID 4608 wrote to memory of 1616 4608 game.exe netsh.exe PID 4608 wrote to memory of 1616 4608 game.exe netsh.exe PID 4608 wrote to memory of 1616 4608 game.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe"C:\Users\Admin\AppData\Local\Temp\e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\game.exe"C:\Users\Admin\AppData\Local\Temp\game.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\game.exe" "game.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\game.exeFilesize
163KB
MD5baf33f6fa9571bd34abe6c5afde6768d
SHA10ce0c82e67151840d385819820673c382804cba9
SHA256e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306
SHA512bfcc27c47861ba491f0ac9504e6b96aa9bb30f6e45652d3840ae96830d9d29bec17e9b7ac17fc31c0ab04046dfd81c71d40376fbc8004307184bdf77b5d1f5f2
-
C:\Users\Admin\AppData\Local\Temp\game.exeFilesize
163KB
MD5baf33f6fa9571bd34abe6c5afde6768d
SHA10ce0c82e67151840d385819820673c382804cba9
SHA256e57d14f759dcbbeab3b91fff1fd171208ff6b68fe397764821282c57eb4b7306
SHA512bfcc27c47861ba491f0ac9504e6b96aa9bb30f6e45652d3840ae96830d9d29bec17e9b7ac17fc31c0ab04046dfd81c71d40376fbc8004307184bdf77b5d1f5f2
-
memory/1616-138-0x0000000000000000-mapping.dmp
-
memory/4608-133-0x0000000000000000-mapping.dmp
-
memory/4608-136-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/4608-139-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/5088-132-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB
-
memory/5088-137-0x0000000074AC0000-0x0000000075071000-memory.dmpFilesize
5.7MB