Analysis
-
max time kernel
165s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:41
Behavioral task
behavioral1
Sample
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe
Resource
win10v2004-20220812-en
General
-
Target
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe
-
Size
29KB
-
MD5
07ae3808ff61ee050d7f46ebc7ae8553
-
SHA1
fcde926f75efadf892e00374f42bace1328a83ad
-
SHA256
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
-
SHA512
3f688d38dfaec6344475c2f14afc3d91edc69fe29d02f5b0404951c0abde03d7e32b629e48eee4a266209602eead12b0e8b34e264aa3ff710de08502b0d390fe
-
SSDEEP
384:8hQXpl7dzns8oDw/LRP55/4GWmqDSeXegLGBsbh0w4wlAokw9OhgOL1vYRGOZzIH:8E7Js8oDSJz4wqZXenBKh0p29SgRQl5
Malware Config
Extracted
njrat
0.6.4
HacKed
heroznt1.no-ip.biz:5552
043268c986c44a75878ff249a24b122e
-
reg_key
043268c986c44a75878ff249a24b122e
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
IDM.exepid process 3188 IDM.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe -
Drops startup file 2 IoCs
Processes:
IDM.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\043268c986c44a75878ff249a24b122e.exe IDM.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\043268c986c44a75878ff249a24b122e.exe IDM.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
IDM.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\043268c986c44a75878ff249a24b122e = "\"C:\\Users\\Admin\\AppData\\Roaming\\IDM.exe\" .." IDM.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\043268c986c44a75878ff249a24b122e = "\"C:\\Users\\Admin\\AppData\\Roaming\\IDM.exe\" .." IDM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
IDM.exepid process 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe 3188 IDM.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
IDM.exedescription pid process Token: SeDebugPrivilege 3188 IDM.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exeIDM.exedescription pid process target process PID 4960 wrote to memory of 3188 4960 7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe IDM.exe PID 4960 wrote to memory of 3188 4960 7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe IDM.exe PID 4960 wrote to memory of 3188 4960 7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe IDM.exe PID 3188 wrote to memory of 4872 3188 IDM.exe netsh.exe PID 3188 wrote to memory of 4872 3188 IDM.exe netsh.exe PID 3188 wrote to memory of 4872 3188 IDM.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe"C:\Users\Admin\AppData\Local\Temp\7a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\IDM.exe"C:\Users\Admin\AppData\Roaming\IDM.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\IDM.exe" "IDM.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\IDM.exeFilesize
29KB
MD507ae3808ff61ee050d7f46ebc7ae8553
SHA1fcde926f75efadf892e00374f42bace1328a83ad
SHA2567a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
SHA5123f688d38dfaec6344475c2f14afc3d91edc69fe29d02f5b0404951c0abde03d7e32b629e48eee4a266209602eead12b0e8b34e264aa3ff710de08502b0d390fe
-
C:\Users\Admin\AppData\Roaming\IDM.exeFilesize
29KB
MD507ae3808ff61ee050d7f46ebc7ae8553
SHA1fcde926f75efadf892e00374f42bace1328a83ad
SHA2567a9574c4cb8d6e2f0b6ebfa852930f05252664e893db6f32fe8c60c809c07393
SHA5123f688d38dfaec6344475c2f14afc3d91edc69fe29d02f5b0404951c0abde03d7e32b629e48eee4a266209602eead12b0e8b34e264aa3ff710de08502b0d390fe
-
memory/3188-133-0x0000000000000000-mapping.dmp
-
memory/3188-138-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/3188-139-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/4872-137-0x0000000000000000-mapping.dmp
-
memory/4960-132-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB
-
memory/4960-136-0x0000000074E80000-0x0000000075431000-memory.dmpFilesize
5.7MB