Overview

overview

10

Static

static

10

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    37KB

  • Sample

    230606-lcllwach99

  • MD5

    738b663cfc11cd8d13b649e744f2eac9

  • SHA1

    acff033151fd4edb675e50e0be2276a0a4ccc97b

  • SHA256

    f0a7d5715cc34a12f251c0a9534f668d0869bc1c152c3ff41df94d3f09b2f5e7

  • SHA512

    f85951bd539a78f8b8a332cbbdb24d9597b7acbc2f1beab2fbfe8607b8c58f99c1e38e76dd78af915b36238e77e2051b1e87dd8cdf415545ccdcc5de48e89ac3

  • SSDEEP

    384:DansiDjT95hL5YyUvZ7vLOw4qYddlrAF+rMRTyN/0L+EcoinblneHQM3epzXlNr2:2vv5zUvZ7blYrlrM+rMRa8Nu/kt

Score
10/10
njrathackeddiscoveryevasionpersistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

dcsacrevc-46676.portmap.host:46676

Mutex

bfa7039437aa776a2ddda121f403086c

Attributes
  • reg_key

    bfa7039437aa776a2ddda121f403086c

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      37KB

    • MD5

      738b663cfc11cd8d13b649e744f2eac9

    • SHA1

      acff033151fd4edb675e50e0be2276a0a4ccc97b

    • SHA256

      f0a7d5715cc34a12f251c0a9534f668d0869bc1c152c3ff41df94d3f09b2f5e7

    • SHA512

      f85951bd539a78f8b8a332cbbdb24d9597b7acbc2f1beab2fbfe8607b8c58f99c1e38e76dd78af915b36238e77e2051b1e87dd8cdf415545ccdcc5de48e89ac3

    • SSDEEP

      384:DansiDjT95hL5YyUvZ7vLOw4qYddlrAF+rMRTyN/0L+EcoinblneHQM3epzXlNr2:2vv5zUvZ7blYrlrM+rMRa8Nu/kt

    Score
    8/10
    discoveryevasionpersistence

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks