Analysis
-
max time kernel
153s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 16:35
Behavioral task
behavioral1
Sample
1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe
Resource
win10v2004-20220901-en
General
-
Target
1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe
-
Size
23KB
-
MD5
9e718fd98508a1e92592ab67b9e12377
-
SHA1
62df73b0a63959e1c0baf7af58cbeff4a1e2860a
-
SHA256
1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3
-
SHA512
4b67d5e7104956154e889fc06353286a8c78365c29f225df81e9081a6afa77ad3237a9e473561a34c02029d199b80eb6512c2cd961b235ce81d6d439d44a9b2e
-
SSDEEP
384:fST2x0W3qZN2ATtRGCfCo9D46BgnqUhL1ZmRvR6JZlbw8hqIusZzZmK:fth+rdfpRpcnuC
Malware Config
Extracted
njrat
0.7d
HacKed By Omar Mora
mora333.ddns.net:5552
2b29df679f5c6b293763f5b4e411b491
-
reg_key
2b29df679f5c6b293763f5b4e411b491
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Internet Explorer.exepid process 1136 Internet Explorer.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
Internet Explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2b29df679f5c6b293763f5b4e411b491.exe Internet Explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2b29df679f5c6b293763f5b4e411b491.exe Internet Explorer.exe -
Loads dropped DLL 1 IoCs
Processes:
1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exepid process 2044 1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Internet Explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b29df679f5c6b293763f5b4e411b491 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Internet Explorer.exe\" .." Internet Explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2b29df679f5c6b293763f5b4e411b491 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Internet Explorer.exe\" .." Internet Explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Internet Explorer.exedescription pid process Token: SeDebugPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe Token: 33 1136 Internet Explorer.exe Token: SeIncBasePriorityPrivilege 1136 Internet Explorer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exeInternet Explorer.exedescription pid process target process PID 2044 wrote to memory of 1136 2044 1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe Internet Explorer.exe PID 2044 wrote to memory of 1136 2044 1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe Internet Explorer.exe PID 2044 wrote to memory of 1136 2044 1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe Internet Explorer.exe PID 2044 wrote to memory of 1136 2044 1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe Internet Explorer.exe PID 1136 wrote to memory of 1904 1136 Internet Explorer.exe netsh.exe PID 1136 wrote to memory of 1904 1136 Internet Explorer.exe netsh.exe PID 1136 wrote to memory of 1904 1136 Internet Explorer.exe netsh.exe PID 1136 wrote to memory of 1904 1136 Internet Explorer.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe"C:\Users\Admin\AppData\Local\Temp\1cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Internet Explorer.exe"C:\Users\Admin\AppData\Roaming\Internet Explorer.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Internet Explorer.exe" "Internet Explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Internet Explorer.exeFilesize
23KB
MD59e718fd98508a1e92592ab67b9e12377
SHA162df73b0a63959e1c0baf7af58cbeff4a1e2860a
SHA2561cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3
SHA5124b67d5e7104956154e889fc06353286a8c78365c29f225df81e9081a6afa77ad3237a9e473561a34c02029d199b80eb6512c2cd961b235ce81d6d439d44a9b2e
-
C:\Users\Admin\AppData\Roaming\Internet Explorer.exeFilesize
23KB
MD59e718fd98508a1e92592ab67b9e12377
SHA162df73b0a63959e1c0baf7af58cbeff4a1e2860a
SHA2561cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3
SHA5124b67d5e7104956154e889fc06353286a8c78365c29f225df81e9081a6afa77ad3237a9e473561a34c02029d199b80eb6512c2cd961b235ce81d6d439d44a9b2e
-
\Users\Admin\AppData\Roaming\Internet Explorer.exeFilesize
23KB
MD59e718fd98508a1e92592ab67b9e12377
SHA162df73b0a63959e1c0baf7af58cbeff4a1e2860a
SHA2561cc1c1281b0adbcd8d4ab94e2b4f3083a3dc7455e3e49cd19cd460185b3885d3
SHA5124b67d5e7104956154e889fc06353286a8c78365c29f225df81e9081a6afa77ad3237a9e473561a34c02029d199b80eb6512c2cd961b235ce81d6d439d44a9b2e
-
memory/1136-58-0x0000000000000000-mapping.dmp
-
memory/1136-63-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/1136-65-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/1904-64-0x0000000000000000-mapping.dmp
-
memory/2044-54-0x0000000075881000-0x0000000075883000-memory.dmpFilesize
8KB
-
memory/2044-55-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/2044-56-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/2044-62-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB