Analysis
-
max time kernel
191s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 16:30
Static task
static1
Behavioral task
behavioral1
Sample
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe
Resource
win10v2004-20220901-en
General
-
Target
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe
-
Size
156KB
-
MD5
36c57457c2c40668e92081f2dfbebdd2
-
SHA1
7413402da144374be19572798e14efe51e72a1cd
-
SHA256
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8
-
SHA512
dab1faf27e8d91b253596d78836bc594a56354af0dbb3530f9fa4cc26194d6f4cfecd16e4911bc4dedf2cee9cf2a9ff38c2ecdc614a08cde7b37fc431fc06b11
-
SSDEEP
3072:Wp9ei9ELN8n4bS8Zl9QJKiFS+RRHlOHdflkRBmolz4wPG:Xi9v4bfL9QJxk+/kFmRf4
Malware Config
Extracted
njrat
0.6.4
new1
yourmain.no-ip.info:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sql_support.exepid process 556 sql_support.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
Processes:
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exepid process 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "C:\\Users\\Admin\\AppData\\Roaming\\MyApps\\chrome.exe" a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exedescription pid process target process PID 1488 set thread context of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exeRegAsm.exepid process 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 516 RegAsm.exe 516 RegAsm.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 516 RegAsm.exe 516 RegAsm.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe Token: SeDebugPrivilege 516 RegAsm.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exeRegAsm.exedescription pid process target process PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 516 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe RegAsm.exe PID 1488 wrote to memory of 556 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe sql_support.exe PID 1488 wrote to memory of 556 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe sql_support.exe PID 1488 wrote to memory of 556 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe sql_support.exe PID 1488 wrote to memory of 556 1488 a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe sql_support.exe PID 516 wrote to memory of 1052 516 RegAsm.exe netsh.exe PID 516 wrote to memory of 1052 516 RegAsm.exe netsh.exe PID 516 wrote to memory of 1052 516 RegAsm.exe netsh.exe PID 516 wrote to memory of 1052 516 RegAsm.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe"C:\Users\Admin\AppData\Local\Temp\a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\sql_support.exe"C:\Users\Admin\AppData\Local\Temp\sql_support.exe" -woohoo 516 C:\Users\Admin\AppData\Local\Temp\chrome.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sql_support.exeFilesize
156KB
MD536c57457c2c40668e92081f2dfbebdd2
SHA17413402da144374be19572798e14efe51e72a1cd
SHA256a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8
SHA512dab1faf27e8d91b253596d78836bc594a56354af0dbb3530f9fa4cc26194d6f4cfecd16e4911bc4dedf2cee9cf2a9ff38c2ecdc614a08cde7b37fc431fc06b11
-
C:\Users\Admin\AppData\Local\Temp\sql_support.exeFilesize
156KB
MD536c57457c2c40668e92081f2dfbebdd2
SHA17413402da144374be19572798e14efe51e72a1cd
SHA256a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8
SHA512dab1faf27e8d91b253596d78836bc594a56354af0dbb3530f9fa4cc26194d6f4cfecd16e4911bc4dedf2cee9cf2a9ff38c2ecdc614a08cde7b37fc431fc06b11
-
\Users\Admin\AppData\Local\Temp\sql_support.exeFilesize
156KB
MD536c57457c2c40668e92081f2dfbebdd2
SHA17413402da144374be19572798e14efe51e72a1cd
SHA256a4ce06d69cd23436729342c89905819e2a20040e0c661b8a02d4895e45e943c8
SHA512dab1faf27e8d91b253596d78836bc594a56354af0dbb3530f9fa4cc26194d6f4cfecd16e4911bc4dedf2cee9cf2a9ff38c2ecdc614a08cde7b37fc431fc06b11
-
memory/516-70-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-58-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-60-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-62-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-64-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-66-0x0000000000408AFE-mapping.dmp
-
memory/516-68-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-82-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/516-57-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/516-79-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/556-80-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/556-73-0x0000000000000000-mapping.dmp
-
memory/556-81-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/1052-77-0x0000000000000000-mapping.dmp
-
memory/1488-55-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/1488-56-0x0000000074960000-0x0000000074F0B000-memory.dmpFilesize
5.7MB
-
memory/1488-54-0x0000000075F01000-0x0000000075F03000-memory.dmpFilesize
8KB