Analysis
-
max time kernel
58s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2023 09:18
General
-
Target
rat.exe
-
Size
64KB
-
MD5
8aa7c1cb0920d957870c48e543c8d0b5
-
SHA1
a7ed7edffeb04b786617b28f7ffde11a84f4f855
-
SHA256
014f0d19ffeff49332c29c1c4edf16523928c822857fbde256d6da21bf6424e8
-
SHA512
7e5f9b77d1a97252b8d388bf42233649a9ecfb6ab6f41dd7756eab5c595c19e34673a670a0cc474e62cd3df0a1906eeb8dd500569dfad058680cd0eff3a509a1
-
SSDEEP
1536:TvDmGXoN36tcQviFw1WeHpYBnvbWfLteF3nLrB9z3nGaF9bUS9vM:TLmGXoN36tcQviFCbHCBn6fWl9zWaF9
Malware Config
Extracted
njrat
Platinum
MyBot
127.0.0.1:54077
steamwebhelper.exe
-
reg_key
steamwebhelper.exe
-
splitter
|Ghost|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rat.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Control Panel\International\Geo\Nation rat.exe -
Executes dropped EXE 2 IoCs
Processes:
steamwebhelper.exesteamwebhelper.exepid process 336 steamwebhelper.exe 3196 steamwebhelper.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rat.exepid process 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe 4784 rat.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
rat.exesteamwebhelper.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4784 rat.exe Token: SeDebugPrivilege 336 steamwebhelper.exe Token: 33 336 steamwebhelper.exe Token: SeIncBasePriorityPrivilege 336 steamwebhelper.exe Token: SeDebugPrivilege 3944 taskmgr.exe Token: SeSystemProfilePrivilege 3944 taskmgr.exe Token: SeCreateGlobalPrivilege 3944 taskmgr.exe Token: 33 336 steamwebhelper.exe Token: SeIncBasePriorityPrivilege 336 steamwebhelper.exe Token: 33 336 steamwebhelper.exe Token: SeIncBasePriorityPrivilege 336 steamwebhelper.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
taskmgr.exepid process 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe -
Suspicious use of SendNotifyMessage 27 IoCs
Processes:
taskmgr.exepid process 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe 3944 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
rat.exesteamwebhelper.exedescription pid process target process PID 4784 wrote to memory of 336 4784 rat.exe steamwebhelper.exe PID 4784 wrote to memory of 336 4784 rat.exe steamwebhelper.exe PID 4784 wrote to memory of 336 4784 rat.exe steamwebhelper.exe PID 336 wrote to memory of 1320 336 steamwebhelper.exe schtasks.exe PID 336 wrote to memory of 1320 336 steamwebhelper.exe schtasks.exe PID 336 wrote to memory of 1320 336 steamwebhelper.exe schtasks.exe PID 336 wrote to memory of 4140 336 steamwebhelper.exe schtasks.exe PID 336 wrote to memory of 4140 336 steamwebhelper.exe schtasks.exe PID 336 wrote to memory of 4140 336 steamwebhelper.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rat.exe"C:\Users\Admin\AppData\Local\Temp\rat.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\steamwebhelper.exe"C:\Users\Admin\steamwebhelper.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "SteamWebService" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "SteamWebService" /tr C:\Users\Admin\steamwebhelper.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\steamwebhelper.exeC:\Users\Admin\steamwebhelper.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\steamwebhelper.exeFilesize
64KB
MD58aa7c1cb0920d957870c48e543c8d0b5
SHA1a7ed7edffeb04b786617b28f7ffde11a84f4f855
SHA256014f0d19ffeff49332c29c1c4edf16523928c822857fbde256d6da21bf6424e8
SHA5127e5f9b77d1a97252b8d388bf42233649a9ecfb6ab6f41dd7756eab5c595c19e34673a670a0cc474e62cd3df0a1906eeb8dd500569dfad058680cd0eff3a509a1
-
C:\Users\Admin\steamwebhelper.exeFilesize
64KB
MD58aa7c1cb0920d957870c48e543c8d0b5
SHA1a7ed7edffeb04b786617b28f7ffde11a84f4f855
SHA256014f0d19ffeff49332c29c1c4edf16523928c822857fbde256d6da21bf6424e8
SHA5127e5f9b77d1a97252b8d388bf42233649a9ecfb6ab6f41dd7756eab5c595c19e34673a670a0cc474e62cd3df0a1906eeb8dd500569dfad058680cd0eff3a509a1
-
C:\Users\Admin\steamwebhelper.exeFilesize
64KB
MD58aa7c1cb0920d957870c48e543c8d0b5
SHA1a7ed7edffeb04b786617b28f7ffde11a84f4f855
SHA256014f0d19ffeff49332c29c1c4edf16523928c822857fbde256d6da21bf6424e8
SHA5127e5f9b77d1a97252b8d388bf42233649a9ecfb6ab6f41dd7756eab5c595c19e34673a670a0cc474e62cd3df0a1906eeb8dd500569dfad058680cd0eff3a509a1
-
C:\Users\Admin\steamwebhelper.exeFilesize
64KB
MD58aa7c1cb0920d957870c48e543c8d0b5
SHA1a7ed7edffeb04b786617b28f7ffde11a84f4f855
SHA256014f0d19ffeff49332c29c1c4edf16523928c822857fbde256d6da21bf6424e8
SHA5127e5f9b77d1a97252b8d388bf42233649a9ecfb6ab6f41dd7756eab5c595c19e34673a670a0cc474e62cd3df0a1906eeb8dd500569dfad058680cd0eff3a509a1
-
memory/336-162-0x00000000012B0000-0x00000000012C0000-memory.dmpFilesize
64KB
-
memory/336-161-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/336-177-0x00000000012B0000-0x00000000012C0000-memory.dmpFilesize
64KB
-
memory/336-163-0x00000000012B0000-0x00000000012C0000-memory.dmpFilesize
64KB
-
memory/336-157-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/336-159-0x00000000012B0000-0x00000000012C0000-memory.dmpFilesize
64KB
-
memory/336-160-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/3944-165-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-173-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-176-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-164-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-175-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-166-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-170-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-172-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-171-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/3944-174-0x0000029FC73D0000-0x0000029FC73D1000-memory.dmpFilesize
4KB
-
memory/4784-133-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/4784-136-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/4784-158-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB
-
memory/4784-135-0x0000000000E50000-0x0000000000E60000-memory.dmpFilesize
64KB
-
memory/4784-134-0x0000000074830000-0x0000000074DE1000-memory.dmpFilesize
5.7MB