Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 17:19
Behavioral task
behavioral1
Sample
85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe
Resource
win10v2004-20230915-en
General
-
Target
85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe
-
Size
37KB
-
MD5
e19f65989c0f892cebe323f2067ce4af
-
SHA1
07ee79b18fe3aa6c6823052ddffa770f18788a74
-
SHA256
85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454
-
SHA512
5a110a6cdeba10cc124444c57ab49e26e9ac697de202178661fae9a228485575bcce69503ecd79d51d93e5524f59728e4b8c18663f2f7cc6f64dcac3acf3f8f8
-
SSDEEP
384:acHsiDrT95hL5YyUvRD/zOo46Al1lrAF+rMRTyN/0L+EcoinblneHQM3epzX5Nr2:Fnv5zUvRDLlAblrM+rMRa8Nuzot
Malware Config
Extracted
njrat
im523
Windows
2.tcp.eu.ngrok.io:19440
a9916e265f04c5cbbcb09972457528f5
-
reg_key
a9916e265f04c5cbbcb09972457528f5
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation 85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe -
Drops startup file 2 IoCs
Processes:
Windows.server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9916e265f04c5cbbcb09972457528f5.exe Windows.server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a9916e265f04c5cbbcb09972457528f5.exe Windows.server.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.server.exepid process 5108 Windows.server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Windows.server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a9916e265f04c5cbbcb09972457528f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.server.exe\" .." Windows.server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a9916e265f04c5cbbcb09972457528f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows.server.exe\" .." Windows.server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
Windows.server.exedescription ioc process File created C:\autorun.inf Windows.server.exe File opened for modification C:\autorun.inf Windows.server.exe File created D:\autorun.inf Windows.server.exe File created F:\autorun.inf Windows.server.exe File opened for modification F:\autorun.inf Windows.server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4984 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Windows.server.exepid process 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe 5108 Windows.server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Windows.server.exepid process 5108 Windows.server.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
Windows.server.exetaskkill.exedescription pid process Token: SeDebugPrivilege 5108 Windows.server.exe Token: SeDebugPrivilege 4984 taskkill.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe Token: 33 5108 Windows.server.exe Token: SeIncBasePriorityPrivilege 5108 Windows.server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exeWindows.server.exedescription pid process target process PID 3920 wrote to memory of 5108 3920 85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe Windows.server.exe PID 3920 wrote to memory of 5108 3920 85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe Windows.server.exe PID 3920 wrote to memory of 5108 3920 85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe Windows.server.exe PID 5108 wrote to memory of 2604 5108 Windows.server.exe netsh.exe PID 5108 wrote to memory of 2604 5108 Windows.server.exe netsh.exe PID 5108 wrote to memory of 2604 5108 Windows.server.exe netsh.exe PID 5108 wrote to memory of 4984 5108 Windows.server.exe taskkill.exe PID 5108 wrote to memory of 4984 5108 Windows.server.exe taskkill.exe PID 5108 wrote to memory of 4984 5108 Windows.server.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe"C:\Users\Admin\AppData\Local\Temp\85f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Windows.server.exe"C:\Users\Admin\AppData\Local\Temp\Windows.server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Windows.server.exe" "Windows.server.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Windows.server.exeFilesize
37KB
MD5e19f65989c0f892cebe323f2067ce4af
SHA107ee79b18fe3aa6c6823052ddffa770f18788a74
SHA25685f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454
SHA5125a110a6cdeba10cc124444c57ab49e26e9ac697de202178661fae9a228485575bcce69503ecd79d51d93e5524f59728e4b8c18663f2f7cc6f64dcac3acf3f8f8
-
C:\Users\Admin\AppData\Local\Temp\Windows.server.exeFilesize
37KB
MD5e19f65989c0f892cebe323f2067ce4af
SHA107ee79b18fe3aa6c6823052ddffa770f18788a74
SHA25685f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454
SHA5125a110a6cdeba10cc124444c57ab49e26e9ac697de202178661fae9a228485575bcce69503ecd79d51d93e5524f59728e4b8c18663f2f7cc6f64dcac3acf3f8f8
-
C:\Users\Admin\AppData\Local\Temp\Windows.server.exeFilesize
37KB
MD5e19f65989c0f892cebe323f2067ce4af
SHA107ee79b18fe3aa6c6823052ddffa770f18788a74
SHA25685f3edacf251c85385541993bc690fabcfc80625b22ec330f4dd6f31c0573454
SHA5125a110a6cdeba10cc124444c57ab49e26e9ac697de202178661fae9a228485575bcce69503ecd79d51d93e5524f59728e4b8c18663f2f7cc6f64dcac3acf3f8f8
-
memory/3920-0-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB
-
memory/3920-1-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB
-
memory/3920-2-0x0000000001A10000-0x0000000001A20000-memory.dmpFilesize
64KB
-
memory/3920-12-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB
-
memory/5108-13-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB
-
memory/5108-14-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB
-
memory/5108-24-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB
-
memory/5108-25-0x0000000074710000-0x0000000074CC1000-memory.dmpFilesize
5.7MB