Analysis
-
max time kernel
65s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 18:00
Behavioral task
behavioral1
Sample
detectable gui by JO1TAR0.exe
Resource
win10v2004-20230220-en
General
-
Target
detectable gui by JO1TAR0.exe
-
Size
43KB
-
MD5
57cdd22688c43ddc013f9fcd6f99229a
-
SHA1
b401750b8761ff693509be4121f8a81a489c65d6
-
SHA256
b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
-
SHA512
5282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
SSDEEP
384:F8ZyoQF3VarE8yTTTfqtiWqEnkDai0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWna/gm:F6zi3MY5TffqtpSDluXQ/ob3+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
5.tcp.eu.ngrok.io:12308
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
detectable gui by JO1TAR0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation detectable gui by JO1TAR0.exe -
Drops startup file 2 IoCs
Processes:
Dllhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 2 IoCs
Processes:
Dllhost.exeServer.exepid process 4740 Dllhost.exe 4388 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dllhost.exe\" .." Dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
taskmgr.exepid process 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
detectable gui by JO1TAR0.exeDllhost.exepid process 2276 detectable gui by JO1TAR0.exe 4740 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
taskmgr.exeDllhost.exedescription pid process Token: SeDebugPrivilege 4012 taskmgr.exe Token: SeSystemProfilePrivilege 4012 taskmgr.exe Token: SeCreateGlobalPrivilege 4012 taskmgr.exe Token: SeDebugPrivilege 4740 Dllhost.exe Token: 33 4740 Dllhost.exe Token: SeIncBasePriorityPrivilege 4740 Dllhost.exe Token: 33 4740 Dllhost.exe Token: SeIncBasePriorityPrivilege 4740 Dllhost.exe Token: 33 4740 Dllhost.exe Token: SeIncBasePriorityPrivilege 4740 Dllhost.exe Token: 33 4740 Dllhost.exe Token: SeIncBasePriorityPrivilege 4740 Dllhost.exe Token: 33 4012 taskmgr.exe Token: SeIncBasePriorityPrivilege 4012 taskmgr.exe Token: 33 4740 Dllhost.exe Token: SeIncBasePriorityPrivilege 4740 Dllhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe 4012 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
detectable gui by JO1TAR0.exeDllhost.exedescription pid process target process PID 2276 wrote to memory of 4740 2276 detectable gui by JO1TAR0.exe Dllhost.exe PID 2276 wrote to memory of 4740 2276 detectable gui by JO1TAR0.exe Dllhost.exe PID 2276 wrote to memory of 4740 2276 detectable gui by JO1TAR0.exe Dllhost.exe PID 4740 wrote to memory of 984 4740 Dllhost.exe schtasks.exe PID 4740 wrote to memory of 984 4740 Dllhost.exe schtasks.exe PID 4740 wrote to memory of 984 4740 Dllhost.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\detectable gui by JO1TAR0.exe"C:\Users\Admin\AppData\Local\Temp\detectable gui by JO1TAR0.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD557cdd22688c43ddc013f9fcd6f99229a
SHA1b401750b8761ff693509be4121f8a81a489c65d6
SHA256b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
SHA5125282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD557cdd22688c43ddc013f9fcd6f99229a
SHA1b401750b8761ff693509be4121f8a81a489c65d6
SHA256b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
SHA5125282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD557cdd22688c43ddc013f9fcd6f99229a
SHA1b401750b8761ff693509be4121f8a81a489c65d6
SHA256b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
SHA5125282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD557cdd22688c43ddc013f9fcd6f99229a
SHA1b401750b8761ff693509be4121f8a81a489c65d6
SHA256b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
SHA5125282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD557cdd22688c43ddc013f9fcd6f99229a
SHA1b401750b8761ff693509be4121f8a81a489c65d6
SHA256b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
SHA5125282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exeFilesize
43KB
MD557cdd22688c43ddc013f9fcd6f99229a
SHA1b401750b8761ff693509be4121f8a81a489c65d6
SHA256b759f0aafb6514247634e21bfe6e8784fe5933172e1528735c068edc1cf62fab
SHA5125282ae3b34af16ea7951edaa1635cc8eb38252551d0b10fe61a27327f41e434fa56d0726b5c6d0b133dca6aec4ec7f0ba92e299a5b756253f69b4eec930e5b98
-
memory/2276-133-0x0000000000760000-0x0000000000772000-memory.dmpFilesize
72KB
-
memory/2276-134-0x0000000005170000-0x000000000520C000-memory.dmpFilesize
624KB
-
memory/2276-135-0x00000000059F0000-0x0000000005F94000-memory.dmpFilesize
5.6MB
-
memory/2276-136-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/2276-137-0x0000000005530000-0x00000000055C2000-memory.dmpFilesize
584KB
-
memory/4012-156-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-158-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-157-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-159-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-160-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-161-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-162-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-152-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-151-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4012-150-0x0000018CFF610000-0x0000018CFF611000-memory.dmpFilesize
4KB
-
memory/4388-169-0x00000000051E0000-0x00000000051F0000-memory.dmpFilesize
64KB
-
memory/4740-165-0x0000000004F90000-0x0000000004F9A000-memory.dmpFilesize
40KB
-
memory/4740-166-0x0000000005210000-0x0000000005276000-memory.dmpFilesize
408KB
-
memory/4740-164-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/4740-147-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB