Analysis
-
max time kernel
152s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 19:16
Behavioral task
behavioral1
Sample
cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe
Resource
win10v2004-20220812-en
General
-
Target
cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe
-
Size
23KB
-
MD5
1b5d01ad390e8ca90fc4708a21f1b846
-
SHA1
88a27e59b8ec194d96a6d5f947a888310f95bbe8
-
SHA256
cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e
-
SHA512
9fd898d36ea7630c31f470b07f97d3fd5f4b0ff8bf870fb7debea0df1dfe6b6ffe751cebdbc9283cfd33b2f9330066d6973c460b4aa9f9c5364a04c345e52586
-
SSDEEP
384:PluBPiZCMfdfSJrQbsLRGSIxYeL46Dg/i8BD9BmRvR6JZlbw8hqIusZzZiZ:4OmhtItRpcnuF
Malware Config
Extracted
njrat
0.7d
HacKed
bodylol2.no-ip.biz:1177
42de0ab5567f78f85e9d2682d65bbf19
-
reg_key
42de0ab5567f78f85e9d2682d65bbf19
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
System.exepid process 840 System.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
System.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42de0ab5567f78f85e9d2682d65bbf19.exe System.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\42de0ab5567f78f85e9d2682d65bbf19.exe System.exe -
Loads dropped DLL 1 IoCs
Processes:
cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exepid process 1544 cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\42de0ab5567f78f85e9d2682d65bbf19 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.exe\" .." System.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\42de0ab5567f78f85e9d2682d65bbf19 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System.exe\" .." System.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
System.exedescription pid process Token: SeDebugPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe Token: 33 840 System.exe Token: SeIncBasePriorityPrivilege 840 System.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exeSystem.exedescription pid process target process PID 1544 wrote to memory of 840 1544 cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe System.exe PID 1544 wrote to memory of 840 1544 cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe System.exe PID 1544 wrote to memory of 840 1544 cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe System.exe PID 1544 wrote to memory of 840 1544 cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe System.exe PID 840 wrote to memory of 592 840 System.exe netsh.exe PID 840 wrote to memory of 592 840 System.exe netsh.exe PID 840 wrote to memory of 592 840 System.exe netsh.exe PID 840 wrote to memory of 592 840 System.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe"C:\Users\Admin\AppData\Local\Temp\cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\System.exe"C:\Users\Admin\AppData\Local\Temp\System.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System.exe" "System.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\System.exeFilesize
23KB
MD51b5d01ad390e8ca90fc4708a21f1b846
SHA188a27e59b8ec194d96a6d5f947a888310f95bbe8
SHA256cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e
SHA5129fd898d36ea7630c31f470b07f97d3fd5f4b0ff8bf870fb7debea0df1dfe6b6ffe751cebdbc9283cfd33b2f9330066d6973c460b4aa9f9c5364a04c345e52586
-
C:\Users\Admin\AppData\Local\Temp\System.exeFilesize
23KB
MD51b5d01ad390e8ca90fc4708a21f1b846
SHA188a27e59b8ec194d96a6d5f947a888310f95bbe8
SHA256cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e
SHA5129fd898d36ea7630c31f470b07f97d3fd5f4b0ff8bf870fb7debea0df1dfe6b6ffe751cebdbc9283cfd33b2f9330066d6973c460b4aa9f9c5364a04c345e52586
-
\Users\Admin\AppData\Local\Temp\System.exeFilesize
23KB
MD51b5d01ad390e8ca90fc4708a21f1b846
SHA188a27e59b8ec194d96a6d5f947a888310f95bbe8
SHA256cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e
SHA5129fd898d36ea7630c31f470b07f97d3fd5f4b0ff8bf870fb7debea0df1dfe6b6ffe751cebdbc9283cfd33b2f9330066d6973c460b4aa9f9c5364a04c345e52586
-
memory/592-63-0x0000000000000000-mapping.dmp
-
memory/840-57-0x0000000000000000-mapping.dmp
-
memory/840-62-0x0000000074530000-0x0000000074ADB000-memory.dmpFilesize
5.7MB
-
memory/840-65-0x0000000074530000-0x0000000074ADB000-memory.dmpFilesize
5.7MB
-
memory/1544-54-0x0000000075681000-0x0000000075683000-memory.dmpFilesize
8KB
-
memory/1544-55-0x0000000074530000-0x0000000074ADB000-memory.dmpFilesize
5.7MB
-
memory/1544-61-0x0000000074530000-0x0000000074ADB000-memory.dmpFilesize
5.7MB