Analysis
-
max time kernel
178s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 08:01
Static task
static1
Behavioral task
behavioral1
Sample
67da6f5ed1373b2d46cfd8f1e9201970.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
67da6f5ed1373b2d46cfd8f1e9201970.exe
Resource
win10v2004-20220812-en
General
-
Target
67da6f5ed1373b2d46cfd8f1e9201970.exe
-
Size
359KB
-
MD5
67da6f5ed1373b2d46cfd8f1e9201970
-
SHA1
1820da1f12be9f23a4de58bfb8d3bffc792b9754
-
SHA256
74a6a6252fa238066d74712c4732b1d6dd517d8a7997ac366ae3f80f4e3aa2f4
-
SHA512
a194c3f766b95a62fcf6927d0e90276f92a8b4c279fa3b882cecec7da3d380ce7882d4647e74e069f9b75149295ba90534897d757b00535f289201635308c787
-
SSDEEP
6144:3jbeip2KAS0aEyBB+CMwQ8XCM66iO/PCWpBEaOltLKUPBXdRRLD1H5KPB:3uKAsEVC6qEJO/PdBQKGtpD1Zk
Malware Config
Extracted
njrat
0.7d
MyBot
alka.ddns.net:4444
610ba357edf3ec0f6e3dbbff929d8468
610ba357edf3ec0f6e3dbbff929d8468
-
reg_key
610ba357edf3ec0f6e3dbbff929d8468
-
splitter
Y262SUCZ4UJJ
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
K.abcK.abcpid process 1096 K.abc 1720 K.abc -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
67da6f5ed1373b2d46cfd8f1e9201970.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 67da6f5ed1373b2d46cfd8f1e9201970.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 67da6f5ed1373b2d46cfd8f1e9201970.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
K.abcdescription pid process target process PID 1096 set thread context of 1720 1096 K.abc K.abc -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
K.abcpid process 1096 K.abc 1096 K.abc -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
K.abcdescription pid process Token: SeDebugPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc Token: 33 1720 K.abc Token: SeIncBasePriorityPrivilege 1720 K.abc -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
K.abcpid process 1096 K.abc -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
67da6f5ed1373b2d46cfd8f1e9201970.exeK.abcK.abcdescription pid process target process PID 1652 wrote to memory of 1096 1652 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 1652 wrote to memory of 1096 1652 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 1652 wrote to memory of 1096 1652 67da6f5ed1373b2d46cfd8f1e9201970.exe K.abc PID 1096 wrote to memory of 5032 1096 K.abc cmd.exe PID 1096 wrote to memory of 5032 1096 K.abc cmd.exe PID 1096 wrote to memory of 5032 1096 K.abc cmd.exe PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1096 wrote to memory of 1720 1096 K.abc K.abc PID 1720 wrote to memory of 5112 1720 K.abc netsh.exe PID 1720 wrote to memory of 5112 1720 K.abc netsh.exe PID 1720 wrote to memory of 5112 1720 K.abc netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67da6f5ed1373b2d46cfd8f1e9201970.exe"C:\Users\Admin\AppData\Local\Temp\67da6f5ed1373b2d46cfd8f1e9201970.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"3⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abc" "K.abc" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.ab_Filesize
75KB
MD5dd1453acce357e3d5f5bed5c4111eb03
SHA1f53b6a4bd4dc74ae2bfcbb97fc34185fa48d5e50
SHA25627714a112709c148cd89b1c15d4b5bd08067d80b27062f419aefe92617702447
SHA512aca348a03eae12d280eed92542435d24e27b1c18c190e5f115f7cc1b57169200a4d3a55300cbf24ff67905c7f91af4b2796a15d7361b70178db67141c1d212f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
104KB
MD57bae06cbe364bb42b8c34fcfb90e3ebd
SHA179129af7efa46244da0676607242f0a6b7e12e78
SHA2566ceaebd55b4a542ef64be1d6971fcfe802e67e2027366c52faacc8a8d325ec7a
SHA512c599b72500a5c17cd5c4a81fcf220a95925aa0e5ad72aa92dd1a469fe6e3c23590c548a0be7ec2c4dbd737511a0a79c1c46436867cf7f0c4df21f8dcea9686cf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K.abcxFilesize
716KB
MD5cd658c18f16aa91907a41bb791070458
SHA1e3fffb5454624ff915e9a91bd41195e939eea933
SHA256b7272f3176b6f08f01ce78fc7e7bcd674393784b4b79a59958f022ad1c22c671
SHA51234a8b0a6d596263461f736a5db9de3ae5eefb1a1270247793514f038df91ed591e411e772efb574122a6a4fba2b9dea530a70782d7daea36b12b90a8a02ea972
-
memory/1096-137-0x00000000007A0000-0x00000000007A5000-memory.dmpFilesize
20KB
-
memory/1096-132-0x0000000000000000-mapping.dmp
-
memory/1720-138-0x0000000000000000-mapping.dmp
-
memory/1720-139-0x0000000000400000-0x0000000000978000-memory.dmpFilesize
5.5MB
-
memory/1720-142-0x0000000073A40000-0x0000000073FF1000-memory.dmpFilesize
5.7MB
-
memory/1720-144-0x0000000073A40000-0x0000000073FF1000-memory.dmpFilesize
5.7MB
-
memory/5032-136-0x0000000000000000-mapping.dmp
-
memory/5112-143-0x0000000000000000-mapping.dmp