Analysis
-
max time kernel
152s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:42
Behavioral task
behavioral1
Sample
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe
Resource
win10v2004-20220812-en
General
-
Target
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe
-
Size
23KB
-
MD5
e0d58f00a4ef29afc8f4b9fab7730fa2
-
SHA1
e047c93a6d5911344efa3dc932b77ef6c140e2ed
-
SHA256
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
-
SHA512
5d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
SSDEEP
384:vY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZ2d:4L2s+tRyRpcnuF
Malware Config
Extracted
njrat
0.7d
1
x-devil50099005.ddns.net:5552
65d6e46c64951a1a3fd770cfd09c2de9
-
reg_key
65d6e46c64951a1a3fd770cfd09c2de9
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
google.exepid process 4916 google.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe -
Drops startup file 2 IoCs
Processes:
google.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65d6e46c64951a1a3fd770cfd09c2de9.exe google.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\65d6e46c64951a1a3fd770cfd09c2de9.exe google.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
google.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\65d6e46c64951a1a3fd770cfd09c2de9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .." google.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\65d6e46c64951a1a3fd770cfd09c2de9 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\google.exe\" .." google.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
google.exedescription pid process Token: SeDebugPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe Token: 33 4916 google.exe Token: SeIncBasePriorityPrivilege 4916 google.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exegoogle.exedescription pid process target process PID 4284 wrote to memory of 4916 4284 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 4284 wrote to memory of 4916 4284 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 4284 wrote to memory of 4916 4284 bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe google.exe PID 4916 wrote to memory of 4892 4916 google.exe netsh.exe PID 4916 wrote to memory of 4892 4916 google.exe netsh.exe PID 4916 wrote to memory of 4892 4916 google.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe"C:\Users\Admin\AppData\Local\Temp\bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\google.exe"C:\Users\Admin\AppData\Local\Temp\google.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\google.exe" "google.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\google.exeFilesize
23KB
MD5e0d58f00a4ef29afc8f4b9fab7730fa2
SHA1e047c93a6d5911344efa3dc932b77ef6c140e2ed
SHA256bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
SHA5125d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
C:\Users\Admin\AppData\Local\Temp\google.exeFilesize
23KB
MD5e0d58f00a4ef29afc8f4b9fab7730fa2
SHA1e047c93a6d5911344efa3dc932b77ef6c140e2ed
SHA256bd77ef3186d1cfc0b89a834f742eee6efe99d8a4bc2dbec694fcfaff7c30a10f
SHA5125d55835123613de27c464bd555d333fe235ad957f67885bcab7304151414c49654317daaa3c1c864f5741c2c84b78d7bc84922f516baf5ea296840260e27f30e
-
memory/4284-132-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4284-133-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4284-137-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4892-139-0x0000000000000000-mapping.dmp
-
memory/4916-134-0x0000000000000000-mapping.dmp
-
memory/4916-138-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB
-
memory/4916-140-0x0000000074A30000-0x0000000074FE1000-memory.dmpFilesize
5.7MB