Analysis
-
max time kernel
1799s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2023 08:08
General
-
Target
lll.exe
-
Size
32KB
-
MD5
532da7c83e4683a2ab594becffc15580
-
SHA1
57d8c7ff3b7bf7bbcf472c5bf5d15a4df1e3b62b
-
SHA256
a01e6a1ce4604181d82e13296191abdb305c97423b9fcbd7ee4ef767f2136ad6
-
SHA512
ad094d12f9e32f099696e325efd26066f513c15c3e7b9c9f7f1c9f38fda49cb93f0ff8a2cbf915be9ff73bdec874c1dd59b0f0791b87c9487fb3828ba336d509
-
SSDEEP
768:b4US21HxSgzxbSLw0cWLjrBv1XQmIDUu0tiLkjI:kWDerRFQVkVjI
Malware Config
Extracted
njrat
0.7d
MyBot
score-told.craft.ply.gg:54077
c54d9760bfa8660be8f7c061194ec438
-
reg_key
c54d9760bfa8660be8f7c061194ec438
-
splitter
Y262SUCZ4UJJ
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
lll.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation lll.exe -
Drops startup file 2 IoCs
Processes:
TrustedInstaller.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c54d9760bfa8660be8f7c061194ec438.exe TrustedInstaller.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c54d9760bfa8660be8f7c061194ec438.exe TrustedInstaller.exe -
Executes dropped EXE 1 IoCs
Processes:
TrustedInstaller.exepid process 4484 TrustedInstaller.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
TrustedInstaller.exepid process 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe 4484 TrustedInstaller.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
TrustedInstaller.exepid process 4484 TrustedInstaller.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TrustedInstaller.exedescription pid process Token: SeDebugPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe Token: SeIncBasePriorityPrivilege 4484 TrustedInstaller.exe Token: 33 4484 TrustedInstaller.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
lll.exeTrustedInstaller.exedescription pid process target process PID 4988 wrote to memory of 4484 4988 lll.exe TrustedInstaller.exe PID 4988 wrote to memory of 4484 4988 lll.exe TrustedInstaller.exe PID 4988 wrote to memory of 4484 4988 lll.exe TrustedInstaller.exe PID 4484 wrote to memory of 3116 4484 TrustedInstaller.exe netsh.exe PID 4484 wrote to memory of 3116 4484 TrustedInstaller.exe netsh.exe PID 4484 wrote to memory of 3116 4484 TrustedInstaller.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lll.exe"C:\Users\Admin\AppData\Local\Temp\lll.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\TrustedInstaller.exe"C:\Users\Admin\TrustedInstaller.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\TrustedInstaller.exe" "TrustedInstaller.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\TrustedInstaller.exeFilesize
32KB
MD5532da7c83e4683a2ab594becffc15580
SHA157d8c7ff3b7bf7bbcf472c5bf5d15a4df1e3b62b
SHA256a01e6a1ce4604181d82e13296191abdb305c97423b9fcbd7ee4ef767f2136ad6
SHA512ad094d12f9e32f099696e325efd26066f513c15c3e7b9c9f7f1c9f38fda49cb93f0ff8a2cbf915be9ff73bdec874c1dd59b0f0791b87c9487fb3828ba336d509
-
C:\Users\Admin\TrustedInstaller.exeFilesize
32KB
MD5532da7c83e4683a2ab594becffc15580
SHA157d8c7ff3b7bf7bbcf472c5bf5d15a4df1e3b62b
SHA256a01e6a1ce4604181d82e13296191abdb305c97423b9fcbd7ee4ef767f2136ad6
SHA512ad094d12f9e32f099696e325efd26066f513c15c3e7b9c9f7f1c9f38fda49cb93f0ff8a2cbf915be9ff73bdec874c1dd59b0f0791b87c9487fb3828ba336d509
-
C:\Users\Admin\TrustedInstaller.exeFilesize
32KB
MD5532da7c83e4683a2ab594becffc15580
SHA157d8c7ff3b7bf7bbcf472c5bf5d15a4df1e3b62b
SHA256a01e6a1ce4604181d82e13296191abdb305c97423b9fcbd7ee4ef767f2136ad6
SHA512ad094d12f9e32f099696e325efd26066f513c15c3e7b9c9f7f1c9f38fda49cb93f0ff8a2cbf915be9ff73bdec874c1dd59b0f0791b87c9487fb3828ba336d509
-
memory/4484-159-0x00000000019C0000-0x00000000019D0000-memory.dmpFilesize
64KB
-
memory/4484-157-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4484-158-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4484-162-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4484-164-0x00000000019C0000-0x00000000019D0000-memory.dmpFilesize
64KB
-
memory/4484-165-0x00000000019C0000-0x00000000019D0000-memory.dmpFilesize
64KB
-
memory/4484-166-0x00000000019C0000-0x00000000019D0000-memory.dmpFilesize
64KB
-
memory/4988-139-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4988-138-0x00000000001D0000-0x00000000001E0000-memory.dmpFilesize
64KB
-
memory/4988-137-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4988-136-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB
-
memory/4988-161-0x00000000745C0000-0x0000000074B71000-memory.dmpFilesize
5.7MB