Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2023 13:16
Behavioral task
behavioral1
Sample
440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe
Resource
win7-20230712-en
General
-
Target
440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe
-
Size
31KB
-
MD5
14874a9249876def878e006ca55ef5e5
-
SHA1
82839c360cee6b8cee93297231d7f98d976fb65f
-
SHA256
440c7be71cbf8ccdea42449f4b0fa4aeef078b59b17fc95851ba0544ab1a577a
-
SHA512
70f441ec37dc3bb32a84d8c838225aa67ac4205907ee87bd377e4f1cbdcb256d61182ee2a6dcee28f1910dddbbebc12c4c476a7f206e335a1d9c4a855198bac9
-
SSDEEP
768:oN8p5d5rLmzxBuJJKye8nu4LPv67QmIDUu0tibSj:zvKO+4jwQVkLj
Malware Config
Extracted
njrat
0.7d
system
147.50.253.241:6522
e4d8b898672502b9751c26f7a748bd76
-
reg_key
e4d8b898672502b9751c26f7a748bd76
-
splitter
Y262SUCZ4UJJ
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
Processes:
system.exepid process 5044 system.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
system.exedescription pid process Token: SeDebugPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe Token: 33 5044 system.exe Token: SeIncBasePriorityPrivilege 5044 system.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exesystem.exedescription pid process target process PID 2804 wrote to memory of 5044 2804 440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe system.exe PID 2804 wrote to memory of 5044 2804 440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe system.exe PID 2804 wrote to memory of 5044 2804 440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe system.exe PID 5044 wrote to memory of 1644 5044 system.exe netsh.exe PID 5044 wrote to memory of 1644 5044 system.exe netsh.exe PID 5044 wrote to memory of 1644 5044 system.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe"C:\Users\Admin\AppData\Local\Temp\440C7BE71CBF8CCDEA42449F4B0FA4AEEF078B59B17FC.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
31KB
MD514874a9249876def878e006ca55ef5e5
SHA182839c360cee6b8cee93297231d7f98d976fb65f
SHA256440c7be71cbf8ccdea42449f4b0fa4aeef078b59b17fc95851ba0544ab1a577a
SHA51270f441ec37dc3bb32a84d8c838225aa67ac4205907ee87bd377e4f1cbdcb256d61182ee2a6dcee28f1910dddbbebc12c4c476a7f206e335a1d9c4a855198bac9
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
31KB
MD514874a9249876def878e006ca55ef5e5
SHA182839c360cee6b8cee93297231d7f98d976fb65f
SHA256440c7be71cbf8ccdea42449f4b0fa4aeef078b59b17fc95851ba0544ab1a577a
SHA51270f441ec37dc3bb32a84d8c838225aa67ac4205907ee87bd377e4f1cbdcb256d61182ee2a6dcee28f1910dddbbebc12c4c476a7f206e335a1d9c4a855198bac9
-
C:\Users\Admin\AppData\Local\Temp\system.exeFilesize
31KB
MD514874a9249876def878e006ca55ef5e5
SHA182839c360cee6b8cee93297231d7f98d976fb65f
SHA256440c7be71cbf8ccdea42449f4b0fa4aeef078b59b17fc95851ba0544ab1a577a
SHA51270f441ec37dc3bb32a84d8c838225aa67ac4205907ee87bd377e4f1cbdcb256d61182ee2a6dcee28f1910dddbbebc12c4c476a7f206e335a1d9c4a855198bac9
-
memory/2804-12-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/2804-2-0x0000000000E70000-0x0000000000E80000-memory.dmpFilesize
64KB
-
memory/2804-1-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/2804-0-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/2804-13-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/5044-14-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/5044-15-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/5044-16-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB
-
memory/5044-17-0x00000000745F0000-0x0000000074BA1000-memory.dmpFilesize
5.7MB
-
memory/5044-18-0x0000000001160000-0x0000000001170000-memory.dmpFilesize
64KB