Analysis
-
max time kernel
202s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:42
Behavioral task
behavioral1
Sample
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe
Resource
win10v2004-20220812-en
General
-
Target
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe
-
Size
23KB
-
MD5
e0d58f00a4ef29afc8f4b9fab7730fa2
-
SHA1
e047c93a6d5911344efa3dc932b77ef6c140e2ed
-
SHA256
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
-
SHA512
5d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
SSDEEP
384:vY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZ2d:4L2s+tRyRpcnuF
Malware Config
Extracted
njrat
0.7d
1
x-devil50099005.ddns.net:5552
65d6e46c64951a1a3fd770cfd09c2de9
-
reg_key
65d6e46c64951a1a3fd770cfd09c2de9
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
google.exepid process 1396 google.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
google.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65d6e46c64951a1a3fd770cfd09c2de9.exe google.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65d6e46c64951a1a3fd770cfd09c2de9.exe google.exe -
Loads dropped DLL 1 IoCs
Processes:
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exepid process 1968 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
google.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\65d6e46c64951a1a3fd770cfd09c2de9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .." google.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\65d6e46c64951a1a3fd770cfd09c2de9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .." google.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
google.exedescription pid process Token: SeDebugPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe Token: 33 1396 google.exe Token: SeIncBasePriorityPrivilege 1396 google.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exegoogle.exedescription pid process target process PID 1968 wrote to memory of 1396 1968 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 1968 wrote to memory of 1396 1968 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 1968 wrote to memory of 1396 1968 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 1968 wrote to memory of 1396 1968 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 1396 wrote to memory of 968 1396 google.exe netsh.exe PID 1396 wrote to memory of 968 1396 google.exe netsh.exe PID 1396 wrote to memory of 968 1396 google.exe netsh.exe PID 1396 wrote to memory of 968 1396 google.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe"C:\Users\Admin\AppData\Local\Temp\bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\google.exe"C:\Users\Admin\AppData\Local\Temp\google.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google.exe" "google.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\google.exeFilesize
23KB
MD5e0d58f00a4ef29afc8f4b9fab7730fa2
SHA1e047c93a6d5911344efa3dc932b77ef6c140e2ed
SHA256bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
SHA5125d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
C:\Users\Admin\AppData\Local\Temp\google.exeFilesize
23KB
MD5e0d58f00a4ef29afc8f4b9fab7730fa2
SHA1e047c93a6d5911344efa3dc932b77ef6c140e2ed
SHA256bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
SHA5125d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
\Users\Admin\AppData\Local\Temp\google.exeFilesize
23KB
MD5e0d58f00a4ef29afc8f4b9fab7730fa2
SHA1e047c93a6d5911344efa3dc932b77ef6c140e2ed
SHA256bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
SHA5125d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
memory/968-64-0x0000000000000000-mapping.dmp
-
memory/1396-58-0x0000000000000000-mapping.dmp
-
memory/1396-63-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1396-66-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1968-54-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1968-55-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1968-56-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB
-
memory/1968-62-0x0000000074590000-0x0000000074B3B000-memory.dmpFilesize
5.7MB