Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2023 01:26
Behavioral task
behavioral1
Sample
e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe
Resource
win10v2004-20230621-en
General
-
Target
e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe
-
Size
2.5MB
-
MD5
86b82eb9809c5d95c1eec8b83d770973
-
SHA1
7a95bfb4ea9b3680c0b7eaf661e2991834c95f9a
-
SHA256
e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6
-
SHA512
49c770f7cc537852c50539a605db0ce33c5f12854d5ca821bc5302391d7200b77b5c88261e481ee9bab9cdca01014c86aeeea4b14cce8365be368520acd9a4df
-
SSDEEP
49152:XZX8rrazq8RyOdT4xC61GyNv5rn0KtX2X8SPSecH:XZHzq+8xn1dhptXNSqXH
Malware Config
Extracted
njrat
im523
Youtube
house-induced.at.ply.gg:42235
aa334bb4a5ba8e94fe328c2fa3c29511
-
reg_key
aa334bb4a5ba8e94fe328c2fa3c29511
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Server.exee22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Control Panel\International\Geo\Nation Server.exe Key value queried \REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\Control Panel\International\Geo\Nation e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe -
Drops startup file 2 IoCs
Processes:
MicrosoftUpdate.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aa334bb4a5ba8e94fe328c2fa3c29511.exe MicrosoftUpdate.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aa334bb4a5ba8e94fe328c2fa3c29511.exe MicrosoftUpdate.exe -
Executes dropped EXE 3 IoCs
Processes:
Server.exebuilder #6.exeMicrosoftUpdate.exepid process 1604 Server.exe 1468 builder #6.exe 4960 MicrosoftUpdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MicrosoftUpdate.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2178924671-3779044592-2825503497-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aa334bb4a5ba8e94fe328c2fa3c29511 = "\"C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftUpdate.exe\" .." MicrosoftUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\aa334bb4a5ba8e94fe328c2fa3c29511 = "\"C:\\Users\\Admin\\AppData\\Roaming\\MicrosoftUpdate.exe\" .." MicrosoftUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MicrosoftUpdate.exepid process 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe 4960 MicrosoftUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
MicrosoftUpdate.exepid process 4960 MicrosoftUpdate.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
MicrosoftUpdate.exedescription pid process Token: SeDebugPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe Token: 33 4960 MicrosoftUpdate.exe Token: SeIncBasePriorityPrivilege 4960 MicrosoftUpdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
builder #6.exepid process 1468 builder #6.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exeServer.exeMicrosoftUpdate.exedescription pid process target process PID 4184 wrote to memory of 1604 4184 e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe Server.exe PID 4184 wrote to memory of 1604 4184 e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe Server.exe PID 4184 wrote to memory of 1604 4184 e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe Server.exe PID 4184 wrote to memory of 1468 4184 e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe builder #6.exe PID 4184 wrote to memory of 1468 4184 e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe builder #6.exe PID 4184 wrote to memory of 1468 4184 e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe builder #6.exe PID 1604 wrote to memory of 4960 1604 Server.exe MicrosoftUpdate.exe PID 1604 wrote to memory of 4960 1604 Server.exe MicrosoftUpdate.exe PID 1604 wrote to memory of 4960 1604 Server.exe MicrosoftUpdate.exe PID 4960 wrote to memory of 1368 4960 MicrosoftUpdate.exe netsh.exe PID 4960 wrote to memory of 1368 4960 MicrosoftUpdate.exe netsh.exe PID 4960 wrote to memory of 1368 4960 MicrosoftUpdate.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe"C:\Users\Admin\AppData\Local\Temp\e22450346ab41e5235c7913740afbd70243c9d16805caca160bd6fc8e56cafb6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\MicrosoftUpdate.exe"C:\Users\Admin\AppData\Roaming\MicrosoftUpdate.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\MicrosoftUpdate.exe" "MicrosoftUpdate.exe" ENABLE4⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Local\Temp\builder #6.exe"C:\Users\Admin\AppData\Local\Temp\builder #6.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
37KB
MD51255704ca414ea9c05ce83d01ee612e3
SHA1ca1790e00ca9cdb43b5ad9ce47696c160b841295
SHA256196809ae788f4bcdabed4b3ed4bd15a96094a17c2bd7835c6e897c70d4118f99
SHA512cf60159193c3a6744a5a4322a46437aedc21b072782d85bb11c1bccfdf888ae904761c9a1e0b0025eff6aa9d9aa1daaeb9eeb74609bac4447dff72576657501f
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
37KB
MD51255704ca414ea9c05ce83d01ee612e3
SHA1ca1790e00ca9cdb43b5ad9ce47696c160b841295
SHA256196809ae788f4bcdabed4b3ed4bd15a96094a17c2bd7835c6e897c70d4118f99
SHA512cf60159193c3a6744a5a4322a46437aedc21b072782d85bb11c1bccfdf888ae904761c9a1e0b0025eff6aa9d9aa1daaeb9eeb74609bac4447dff72576657501f
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
37KB
MD51255704ca414ea9c05ce83d01ee612e3
SHA1ca1790e00ca9cdb43b5ad9ce47696c160b841295
SHA256196809ae788f4bcdabed4b3ed4bd15a96094a17c2bd7835c6e897c70d4118f99
SHA512cf60159193c3a6744a5a4322a46437aedc21b072782d85bb11c1bccfdf888ae904761c9a1e0b0025eff6aa9d9aa1daaeb9eeb74609bac4447dff72576657501f
-
C:\Users\Admin\AppData\Local\Temp\builder #6.exeFilesize
2.4MB
MD59729d33f5cc788e9c1930bcc968acffa
SHA168c662875f7b805dd6f246919d406c8d92158073
SHA2563711a334cb3c6e2a92461067f2d7db2946e9b139f1517b214bc929ba42a86aae
SHA512af12beee6da79e5498eb292eb4a122667bf5dcdf840def97a5476adb31e0701a2aa0585b4266547bb4307c3524c7f9733dbf32f2a87c87b33fadb4bb1ecd0c3f
-
C:\Users\Admin\AppData\Local\Temp\builder #6.exeFilesize
2.4MB
MD59729d33f5cc788e9c1930bcc968acffa
SHA168c662875f7b805dd6f246919d406c8d92158073
SHA2563711a334cb3c6e2a92461067f2d7db2946e9b139f1517b214bc929ba42a86aae
SHA512af12beee6da79e5498eb292eb4a122667bf5dcdf840def97a5476adb31e0701a2aa0585b4266547bb4307c3524c7f9733dbf32f2a87c87b33fadb4bb1ecd0c3f
-
C:\Users\Admin\AppData\Local\Temp\builder #6.exeFilesize
2.4MB
MD59729d33f5cc788e9c1930bcc968acffa
SHA168c662875f7b805dd6f246919d406c8d92158073
SHA2563711a334cb3c6e2a92461067f2d7db2946e9b139f1517b214bc929ba42a86aae
SHA512af12beee6da79e5498eb292eb4a122667bf5dcdf840def97a5476adb31e0701a2aa0585b4266547bb4307c3524c7f9733dbf32f2a87c87b33fadb4bb1ecd0c3f
-
C:\Users\Admin\AppData\Roaming\MicrosoftUpdate.exeFilesize
37KB
MD51255704ca414ea9c05ce83d01ee612e3
SHA1ca1790e00ca9cdb43b5ad9ce47696c160b841295
SHA256196809ae788f4bcdabed4b3ed4bd15a96094a17c2bd7835c6e897c70d4118f99
SHA512cf60159193c3a6744a5a4322a46437aedc21b072782d85bb11c1bccfdf888ae904761c9a1e0b0025eff6aa9d9aa1daaeb9eeb74609bac4447dff72576657501f
-
C:\Users\Admin\AppData\Roaming\MicrosoftUpdate.exeFilesize
37KB
MD51255704ca414ea9c05ce83d01ee612e3
SHA1ca1790e00ca9cdb43b5ad9ce47696c160b841295
SHA256196809ae788f4bcdabed4b3ed4bd15a96094a17c2bd7835c6e897c70d4118f99
SHA512cf60159193c3a6744a5a4322a46437aedc21b072782d85bb11c1bccfdf888ae904761c9a1e0b0025eff6aa9d9aa1daaeb9eeb74609bac4447dff72576657501f
-
memory/1468-151-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/1468-162-0x0000000000400000-0x0000000000671000-memory.dmpFilesize
2.4MB
-
memory/1468-163-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/1604-150-0x00000000015D0000-0x00000000015E0000-memory.dmpFilesize
64KB
-
memory/4184-148-0x0000000000400000-0x0000000000680000-memory.dmpFilesize
2.5MB
-
memory/4960-161-0x0000000000E30000-0x0000000000E40000-memory.dmpFilesize
64KB
-
memory/4960-165-0x0000000000E30000-0x0000000000E40000-memory.dmpFilesize
64KB