Analysis
-
max time kernel
248s -
max time network
334s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:42
Behavioral task
behavioral1
Sample
Users/win7/Desktop/Server.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Users/win7/Desktop/Server.exe
Resource
win10v2004-20221111-en
General
-
Target
Users/win7/Desktop/Server.exe
-
Size
23KB
-
MD5
7195a553b760af0b64a685f8dea1900d
-
SHA1
6c50a8f5357135e7f738664bf633e8bbc2cbeee8
-
SHA256
918262180108f962670a5b413a00e8ff193fe50873a176f68241960dc62480d4
-
SHA512
d67c1a715182dfc4945a210e64a305f02b227d78adf5731601bb774ed62fe9b91b547ad2a8f9fd4d331ccba1d347590cb8812b2e9af83b785925e59ca3e616f9
-
SSDEEP
384:E4Q+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZ4dJ:GOaxVULRpcnut
Malware Config
Extracted
njrat
0.7d
hacke
yusifhacker123.no-ip.biz:5552
b5fa757354bbe4709ff7d91d5edc7795
-
reg_key
b5fa757354bbe4709ff7d91d5edc7795
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
trojan.exepid process 1180 trojan.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
Server.exepid process 700 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
trojan.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\b5fa757354bbe4709ff7d91d5edc7795 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\trojan.exe\" .." trojan.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\b5fa757354bbe4709ff7d91d5edc7795 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\trojan.exe\" .." trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
trojan.exedescription pid process Token: SeDebugPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe Token: 33 1180 trojan.exe Token: SeIncBasePriorityPrivilege 1180 trojan.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Server.exetrojan.exedescription pid process target process PID 700 wrote to memory of 1180 700 Server.exe trojan.exe PID 700 wrote to memory of 1180 700 Server.exe trojan.exe PID 700 wrote to memory of 1180 700 Server.exe trojan.exe PID 700 wrote to memory of 1180 700 Server.exe trojan.exe PID 1180 wrote to memory of 788 1180 trojan.exe netsh.exe PID 1180 wrote to memory of 788 1180 trojan.exe netsh.exe PID 1180 wrote to memory of 788 1180 trojan.exe netsh.exe PID 1180 wrote to memory of 788 1180 trojan.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Users\win7\Desktop\Server.exe"C:\Users\Admin\AppData\Local\Temp\Users\win7\Desktop\Server.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\trojan.exe"C:\Users\Admin\AppData\Local\Temp\trojan.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\trojan.exe" "trojan.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\trojan.exeFilesize
23KB
MD57195a553b760af0b64a685f8dea1900d
SHA16c50a8f5357135e7f738664bf633e8bbc2cbeee8
SHA256918262180108f962670a5b413a00e8ff193fe50873a176f68241960dc62480d4
SHA512d67c1a715182dfc4945a210e64a305f02b227d78adf5731601bb774ed62fe9b91b547ad2a8f9fd4d331ccba1d347590cb8812b2e9af83b785925e59ca3e616f9
-
C:\Users\Admin\AppData\Local\Temp\trojan.exeFilesize
23KB
MD57195a553b760af0b64a685f8dea1900d
SHA16c50a8f5357135e7f738664bf633e8bbc2cbeee8
SHA256918262180108f962670a5b413a00e8ff193fe50873a176f68241960dc62480d4
SHA512d67c1a715182dfc4945a210e64a305f02b227d78adf5731601bb774ed62fe9b91b547ad2a8f9fd4d331ccba1d347590cb8812b2e9af83b785925e59ca3e616f9
-
\Users\Admin\AppData\Local\Temp\trojan.exeFilesize
23KB
MD57195a553b760af0b64a685f8dea1900d
SHA16c50a8f5357135e7f738664bf633e8bbc2cbeee8
SHA256918262180108f962670a5b413a00e8ff193fe50873a176f68241960dc62480d4
SHA512d67c1a715182dfc4945a210e64a305f02b227d78adf5731601bb774ed62fe9b91b547ad2a8f9fd4d331ccba1d347590cb8812b2e9af83b785925e59ca3e616f9
-
memory/700-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/700-55-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/700-61-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/788-63-0x0000000000000000-mapping.dmp
-
memory/1180-57-0x0000000000000000-mapping.dmp
-
memory/1180-62-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB
-
memory/1180-64-0x0000000074000000-0x00000000745AB000-memory.dmpFilesize
5.7MB