Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe
Resource
win10v2004-20220901-en
General
-
Target
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe
-
Size
96KB
-
MD5
2ca52f3cc07363063db01a026b273a80
-
SHA1
a8428bf7a28e6c8daad18d4604c22ad4fe4eedf2
-
SHA256
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779
-
SHA512
d9efc481fd07fc7bed353dfdb472b5ed06a64a64f60263380bc66ff5cfcbb8a16bbab0fec12e825e4d6d5765ba8be0f73ded53bf338cf85615c29e920502d700
-
SSDEEP
1536:r1/F8CpxMCAgF9DLi+DOGL2NJJhVHYb9:JH2+DOGKJvs9
Malware Config
Extracted
njrat
0.6.4
hkrooz
hkrooz.no-ip.biz:999
75b91df45b7ea5f1132228db5d247dde
-
reg_key
75b91df45b7ea5f1132228db5d247dde
-
splitter
|'|'|
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
system32.exesystem32.exepid process 3360 system32.exe 1448 system32.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe -
Drops startup file 2 IoCs
Processes:
system32.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75b91df45b7ea5f1132228db5d247dde.exe system32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\75b91df45b7ea5f1132228db5d247dde.exe system32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
system32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\75b91df45b7ea5f1132228db5d247dde = "\"C:\\Users\\Admin\\system32.exe\" .." system32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\75b91df45b7ea5f1132228db5d247dde = "\"C:\\Users\\Admin\\system32.exe\" .." system32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exesystem32.exedescription pid process target process PID 4980 set thread context of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 3360 set thread context of 1448 3360 system32.exe system32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
system32.exepid process 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe 1448 system32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exesystem32.exesystem32.exedescription pid process Token: SeDebugPrivilege 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe Token: SeDebugPrivilege 3360 system32.exe Token: SeDebugPrivilege 1448 system32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exesystem32.exesystem32.exedescription pid process target process PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 4980 wrote to memory of 1176 4980 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe PID 1176 wrote to memory of 3360 1176 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe system32.exe PID 1176 wrote to memory of 3360 1176 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe system32.exe PID 1176 wrote to memory of 3360 1176 4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 3360 wrote to memory of 1448 3360 system32.exe system32.exe PID 1448 wrote to memory of 2948 1448 system32.exe netsh.exe PID 1448 wrote to memory of 2948 1448 system32.exe netsh.exe PID 1448 wrote to memory of 2948 1448 system32.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe"C:\Users\Admin\AppData\Local\Temp\4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exeC:\Users\Admin\AppData\Local\Temp\4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\system32.exe"C:\Users\Admin\system32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\system32.exeC:\Users\Admin\system32.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\system32.exe" "system32.exe" ENABLE5⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\4c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779.exe.logFilesize
319B
MD591046f2e147049d3e53cd9bf9d4d95ed
SHA1228e347d062840b2edcbd16904475aacad414c62
SHA256ea92f8291b86440b98162409b1f9f04470455c22be01a1480ea5ebc37eb168dc
SHA512071a9c6e17760a726c3a4519cf8006f36f17f50946af0129e0e1f3e480f6b7fcc804a7614b044247f2420a8b2b46bec5b8493e4869bb918bc7c0f6aa1346c3e0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\system32.exe.logFilesize
319B
MD591046f2e147049d3e53cd9bf9d4d95ed
SHA1228e347d062840b2edcbd16904475aacad414c62
SHA256ea92f8291b86440b98162409b1f9f04470455c22be01a1480ea5ebc37eb168dc
SHA512071a9c6e17760a726c3a4519cf8006f36f17f50946af0129e0e1f3e480f6b7fcc804a7614b044247f2420a8b2b46bec5b8493e4869bb918bc7c0f6aa1346c3e0
-
C:\Users\Admin\system32.exeFilesize
96KB
MD52ca52f3cc07363063db01a026b273a80
SHA1a8428bf7a28e6c8daad18d4604c22ad4fe4eedf2
SHA2564c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779
SHA512d9efc481fd07fc7bed353dfdb472b5ed06a64a64f60263380bc66ff5cfcbb8a16bbab0fec12e825e4d6d5765ba8be0f73ded53bf338cf85615c29e920502d700
-
C:\Users\Admin\system32.exeFilesize
96KB
MD52ca52f3cc07363063db01a026b273a80
SHA1a8428bf7a28e6c8daad18d4604c22ad4fe4eedf2
SHA2564c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779
SHA512d9efc481fd07fc7bed353dfdb472b5ed06a64a64f60263380bc66ff5cfcbb8a16bbab0fec12e825e4d6d5765ba8be0f73ded53bf338cf85615c29e920502d700
-
C:\Users\Admin\system32.exeFilesize
96KB
MD52ca52f3cc07363063db01a026b273a80
SHA1a8428bf7a28e6c8daad18d4604c22ad4fe4eedf2
SHA2564c9712069db7e8568caed8023e3742676cc7aecda48ac6f2422ad6fefdd8c779
SHA512d9efc481fd07fc7bed353dfdb472b5ed06a64a64f60263380bc66ff5cfcbb8a16bbab0fec12e825e4d6d5765ba8be0f73ded53bf338cf85615c29e920502d700
-
memory/1176-136-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/1176-141-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/1176-134-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1176-133-0x0000000000000000-mapping.dmp
-
memory/1448-142-0x0000000000000000-mapping.dmp
-
memory/1448-148-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/1448-149-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/2948-147-0x0000000000000000-mapping.dmp
-
memory/3360-137-0x0000000000000000-mapping.dmp
-
memory/3360-146-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/4980-132-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB
-
memory/4980-135-0x0000000074770000-0x0000000074D21000-memory.dmpFilesize
5.7MB