General
-
Target
3d74997f9d6119c548ece090039064ff0d0f068a25a917ba5932e2eee912b5a1
-
Size
188KB
-
Sample
221127-tqyglaee9t
-
MD5
77d9730ba438cb29ff4a8babb744ab74
-
SHA1
457ed2d1c824a04703c00b81c2e24777ef7f1afa
-
SHA256
3d74997f9d6119c548ece090039064ff0d0f068a25a917ba5932e2eee912b5a1
-
SHA512
27f43d7b2db78642f277dcd3cbf399e7c4d444b8a039a4a58b4bf90cff37f50c3c3288dfc5b8cfcf320d910b9c59b7c20a147ad8bf76585d3ea0e20eb3f5b908
-
SSDEEP
3072:BNySWs/68TCNOaLHjc56c29oHJ7riVkjLnkvOX7NK5/vCQge8iJhNz7jiR7vVK/v:PRWqONbPc29Y3zNC/6Qgop47w/8yq2
Static task
static1
Behavioral task
behavioral1
Sample
3d74997f9d6119c548ece090039064ff0d0f068a25a917ba5932e2eee912b5a1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3d74997f9d6119c548ece090039064ff0d0f068a25a917ba5932e2eee912b5a1.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
njrat
0.7d
HacKed
immoniter.mooo.com:9103
d90aa8b54f241f86a0f9287800ba7533
-
reg_key
d90aa8b54f241f86a0f9287800ba7533
-
splitter
|'|'|
Targets
-
-
Target
3d74997f9d6119c548ece090039064ff0d0f068a25a917ba5932e2eee912b5a1
-
Size
188KB
-
MD5
77d9730ba438cb29ff4a8babb744ab74
-
SHA1
457ed2d1c824a04703c00b81c2e24777ef7f1afa
-
SHA256
3d74997f9d6119c548ece090039064ff0d0f068a25a917ba5932e2eee912b5a1
-
SHA512
27f43d7b2db78642f277dcd3cbf399e7c4d444b8a039a4a58b4bf90cff37f50c3c3288dfc5b8cfcf320d910b9c59b7c20a147ad8bf76585d3ea0e20eb3f5b908
-
SSDEEP
3072:BNySWs/68TCNOaLHjc56c29oHJ7riVkjLnkvOX7NK5/vCQge8iJhNz7jiR7vVK/v:PRWqONbPc29Y3zNC/6Qgop47w/8yq2
Score10/10-
Modifies WinLogon for persistence
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-