Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 08:01
Static task
static1
Behavioral task
behavioral1
Sample
67da6f5ed1373b2d46cfd8f1e9201970.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
67da6f5ed1373b2d46cfd8f1e9201970.exe
Resource
win10v2004-20220812-en
General
-
Target
67da6f5ed1373b2d46cfd8f1e9201970.exe
-
Size
359KB
-
MD5
67da6f5ed1373b2d46cfd8f1e9201970
-
SHA1
1820da1f12be9f23a4de58bfb8d3bffc792b9754
-
SHA256
74a6a6252fa238066d74712c4732b1d6dd517d8a7997ac366ae3f80f4e3aa2f4
-
SHA512
a194c3f766b95a62fcf6927d0e90276f92a8b4c279fa3b882cecec7da3d380ce7882d4647e74e069f9b75149295ba90534897d757b00535f289201635308c787
-
SSDEEP
6144:3jbeip2KAS0aEyBB+CMwQ8XCM66iO/PCWpBEaOltLKUPBXdRRLD1H5KPB:3uKAsEVC6qEJO/PdBQKGtpD1Zk
Malware Config
Extracted
njrat
0.7d
MyBot
alka.ddns.net:4444
610ba357edf3ec0f6e3dbbff929d8468
-
reg_key
610ba357edf3ec0f6e3dbbff929d8468
-
splitter
Y262SUCZ4UJJ
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
K.abcK.abcpid process 948 K.abc 1380 K.abc -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Loads dropped DLL 3 IoCs
Processes:
67da6f5ed1373b2d46cfd8f1e9201970.exeK.abcpid process 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe 948 K.abc -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
67da6f5ed1373b2d46cfd8f1e9201970.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67da6f5ed1373b2d46cfd8f1e9201970.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 67da6f5ed1373b2d46cfd8f1e9201970.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
K.abcdescription pid process target process PID 948 set thread context of 1380 948 K.abc K.abc -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
K.abcpid process 948 K.abc -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
K.abcdescription pid process Token: SeDebugPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc Token: 33 1380 K.abc Token: SeIncBasePriorityPrivilege 1380 K.abc -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
K.abcpid process 948 K.abc -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
67da6f5ed1373b2d46cfd8f1e9201970.exeK.abcK.abcdescription pid process target process PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 2028 wrote to memory of 948 2028 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1784 948 K.abc cmd.exe PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 948 wrote to memory of 1380 948 K.abc K.abc PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe PID 1380 wrote to memory of 1156 1380 K.abc netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67da6f5ed1373b2d46cfd8f1e9201970.exe"C:\Users\Admin\AppData\Local\Temp\67da6f5ed1373b2d46cfd8f1e9201970.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"3⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc" "K.abc" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.ab_Filesize
75KB
MD5dd1453acce357e3d5f5bed5c4111eb03
SHA1f53b6a4bd4dc74ae2bfcbb97fc34185fa48d5e50
SHA25627714a112709c148cd89b1c15d4b5bd08067d80b27062f419aefe92617702447
SHA512aca348a03eae12d280eed92542435d24e27b1c18c190e5f115f7cc1b57169200a4d3a55300cbf24ff67905c7f91af4b2796a15d7361b70178db67141c1d212f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
104KB
MD542ccd69a3be9618d329de0ea0fde3a81
SHA147e9897f303496eb9cd5883f9cdb283b6eee65d3
SHA25614137fcc8697e967b251fd0fafbdf79af8db4c1a67f2eafe53756e3ad80a9bef
SHA51233d95b20ce606441c89dbc575c8e884196a19db056ffd9d54a5e0c57f3928b0d064b6270e4abf033046606e0456156faba3f3a8e6a353e924a7461e61e46bfae
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
104KB
MD542ccd69a3be9618d329de0ea0fde3a81
SHA147e9897f303496eb9cd5883f9cdb283b6eee65d3
SHA25614137fcc8697e967b251fd0fafbdf79af8db4c1a67f2eafe53756e3ad80a9bef
SHA51233d95b20ce606441c89dbc575c8e884196a19db056ffd9d54a5e0c57f3928b0d064b6270e4abf033046606e0456156faba3f3a8e6a353e924a7461e61e46bfae
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
memory/948-57-0x0000000000000000-mapping.dmp
-
memory/948-64-0x0000000000270000-0x0000000000275000-memory.dmpFilesize
20KB
-
memory/1156-86-0x0000000000000000-mapping.dmp
-
memory/1380-80-0x0000000000402000-0x0000000000409600-memory.dmpFilesize
29KB
-
memory/1380-77-0x000000000040951E-mapping.dmp
-
memory/1380-70-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-71-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-72-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-74-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-75-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-76-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-68-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-67-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1380-88-0x0000000074430000-0x00000000749DB000-memory.dmpFilesize
5.7MB
-
memory/1380-81-0x0000000000402000-0x0000000000409600-memory.dmpFilesize
29KB
-
memory/1380-66-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/1380-84-0x0000000074430000-0x00000000749DB000-memory.dmpFilesize
5.7MB
-
memory/1380-85-0x0000000000409000-0x000000000040A000-memory.dmpFilesize
4KB
-
memory/1784-62-0x0000000000000000-mapping.dmp
-
memory/2028-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB