Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 22:42
Static task
static1
Behavioral task
behavioral1
Sample
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe
Resource
win10v2004-20221111-en
General
-
Target
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe
-
Size
356KB
-
MD5
779f561dc93adbf2b40e92ac374f7cf5
-
SHA1
562ca1be06ff75f55893fa5472abbf7bb9fa6625
-
SHA256
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa
-
SHA512
d1a3f889c6f60b49d07519ddc73f9108012c8e4b81a01328ac75400bd10888428fed84c81a32da3ff00644e3149ba8ad4fd9720d2bb4c0819619e9f9f2069501
-
SSDEEP
6144:9LM3L6hWtnvqI6vzkGTxapOEBqa5tXc8s:hMbaWtn6vzkYmVjC8s
Malware Config
Extracted
njrat
0.7d
FBautoliker103
182.191.88.102:5555
246bc91174535f2c90a8931dec64f396
-
reg_key
246bc91174535f2c90a8931dec64f396
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
server.exeserver.exepid process 1524 server.exe 632 server.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\246bc91174535f2c90a8931dec64f396.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\246bc91174535f2c90a8931dec64f396.exe server.exe -
Loads dropped DLL 2 IoCs
Processes:
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exeserver.exepid process 112 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 1524 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\246bc91174535f2c90a8931dec64f396 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\246bc91174535f2c90a8931dec64f396 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exeserver.exedescription pid process target process PID 2044 set thread context of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 1524 set thread context of 632 1524 server.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exeserver.exeserver.exedescription pid process Token: SeDebugPrivilege 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe Token: SeDebugPrivilege 1524 server.exe Token: SeDebugPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe Token: 33 632 server.exe Token: SeIncBasePriorityPrivilege 632 server.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exeserver.exeserver.exedescription pid process target process PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 2044 wrote to memory of 112 2044 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe PID 112 wrote to memory of 1524 112 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe server.exe PID 112 wrote to memory of 1524 112 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe server.exe PID 112 wrote to memory of 1524 112 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe server.exe PID 112 wrote to memory of 1524 112 2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 1524 wrote to memory of 632 1524 server.exe server.exe PID 632 wrote to memory of 836 632 server.exe netsh.exe PID 632 wrote to memory of 836 632 server.exe netsh.exe PID 632 wrote to memory of 836 632 server.exe netsh.exe PID 632 wrote to memory of 836 632 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe"C:\Users\Admin\AppData\Local\Temp\2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exeC:\Users\Admin\AppData\Local\Temp\2df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp\server.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
356KB
MD5779f561dc93adbf2b40e92ac374f7cf5
SHA1562ca1be06ff75f55893fa5472abbf7bb9fa6625
SHA2562df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa
SHA512d1a3f889c6f60b49d07519ddc73f9108012c8e4b81a01328ac75400bd10888428fed84c81a32da3ff00644e3149ba8ad4fd9720d2bb4c0819619e9f9f2069501
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
356KB
MD5779f561dc93adbf2b40e92ac374f7cf5
SHA1562ca1be06ff75f55893fa5472abbf7bb9fa6625
SHA2562df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa
SHA512d1a3f889c6f60b49d07519ddc73f9108012c8e4b81a01328ac75400bd10888428fed84c81a32da3ff00644e3149ba8ad4fd9720d2bb4c0819619e9f9f2069501
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
356KB
MD5779f561dc93adbf2b40e92ac374f7cf5
SHA1562ca1be06ff75f55893fa5472abbf7bb9fa6625
SHA2562df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa
SHA512d1a3f889c6f60b49d07519ddc73f9108012c8e4b81a01328ac75400bd10888428fed84c81a32da3ff00644e3149ba8ad4fd9720d2bb4c0819619e9f9f2069501
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
356KB
MD5779f561dc93adbf2b40e92ac374f7cf5
SHA1562ca1be06ff75f55893fa5472abbf7bb9fa6625
SHA2562df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa
SHA512d1a3f889c6f60b49d07519ddc73f9108012c8e4b81a01328ac75400bd10888428fed84c81a32da3ff00644e3149ba8ad4fd9720d2bb4c0819619e9f9f2069501
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
356KB
MD5779f561dc93adbf2b40e92ac374f7cf5
SHA1562ca1be06ff75f55893fa5472abbf7bb9fa6625
SHA2562df351f2e7e6f1340f81c6431e88fb2b78f2eaefce58763e7bfd5214985aeaaa
SHA512d1a3f889c6f60b49d07519ddc73f9108012c8e4b81a01328ac75400bd10888428fed84c81a32da3ff00644e3149ba8ad4fd9720d2bb4c0819619e9f9f2069501
-
memory/112-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-69-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/112-62-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-63-0x000000000040748E-mapping.dmp
-
memory/112-66-0x0000000000402000-0x0000000000407600-memory.dmpFilesize
21KB
-
memory/112-65-0x0000000000402000-0x0000000000407600-memory.dmpFilesize
21KB
-
memory/112-75-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/112-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/632-83-0x000000000040748E-mapping.dmp
-
memory/632-93-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/632-90-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/836-91-0x0000000000000000-mapping.dmp
-
memory/1524-71-0x0000000000000000-mapping.dmp
-
memory/1524-89-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/2044-55-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/2044-56-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB
-
memory/2044-54-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/2044-68-0x0000000074D80000-0x000000007532B000-memory.dmpFilesize
5.7MB