Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2023 02:46
Behavioral task
behavioral1
Sample
18629444d2e20b32df0c82d841a62932.exe
Resource
win7-20231023-en
General
-
Target
18629444d2e20b32df0c82d841a62932.exe
-
Size
93KB
-
MD5
18629444d2e20b32df0c82d841a62932
-
SHA1
ec89a43abc1042e3633fc2fced4e5b124e1ac21e
-
SHA256
8955098f1b1c57da1df80af66914bb7f9eee468ca8199e23a0415e1bbe8ad339
-
SHA512
11687ab89f3f837f7e7b838cf15d80bb1614386072263f8a65dee4508a96241b8ba009edd1d87d02076048fa692c332b40804c3db4705c547bced5ad3e95416a
-
SSDEEP
768:HY3repD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3LsGT:6eLOx6baIa9RPj00ljEwzGi1dD3DfgS
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
7.tcp.eu.ngrok.io:14627
53a45de85575719ff2b4dac083ed4905
-
reg_key
53a45de85575719ff2b4dac083ed4905
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
18629444d2e20b32df0c82d841a62932.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation 18629444d2e20b32df0c82d841a62932.exe -
Drops startup file 6 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\53a45de85575719ff2b4dac083ed4905Windows Update.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\53a45de85575719ff2b4dac083ed4905Windows Update.exe server.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe server.exe -
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 4272 server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 2 IoCs
Processes:
server.exedescription ioc process File created C:\Windows\SysWOW64\Explower.exe server.exe File opened for modification C:\Windows\SysWOW64\Explower.exe server.exe -
Drops file in Program Files directory 2 IoCs
Processes:
server.exedescription ioc process File created C:\Program Files (x86)\Explower.exe server.exe File opened for modification C:\Program Files (x86)\Explower.exe server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
server.exepid process 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe 4272 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid process 4272 server.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe Token: 33 4272 server.exe Token: SeIncBasePriorityPrivilege 4272 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
18629444d2e20b32df0c82d841a62932.exeserver.exedescription pid process target process PID 4596 wrote to memory of 4272 4596 18629444d2e20b32df0c82d841a62932.exe server.exe PID 4596 wrote to memory of 4272 4596 18629444d2e20b32df0c82d841a62932.exe server.exe PID 4596 wrote to memory of 4272 4596 18629444d2e20b32df0c82d841a62932.exe server.exe PID 4272 wrote to memory of 3932 4272 server.exe netsh.exe PID 4272 wrote to memory of 3932 4272 server.exe netsh.exe PID 4272 wrote to memory of 3932 4272 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18629444d2e20b32df0c82d841a62932.exe"C:\Users\Admin\AppData\Local\Temp\18629444d2e20b32df0c82d841a62932.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
93KB
MD518629444d2e20b32df0c82d841a62932
SHA1ec89a43abc1042e3633fc2fced4e5b124e1ac21e
SHA2568955098f1b1c57da1df80af66914bb7f9eee468ca8199e23a0415e1bbe8ad339
SHA51211687ab89f3f837f7e7b838cf15d80bb1614386072263f8a65dee4508a96241b8ba009edd1d87d02076048fa692c332b40804c3db4705c547bced5ad3e95416a
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
93KB
MD518629444d2e20b32df0c82d841a62932
SHA1ec89a43abc1042e3633fc2fced4e5b124e1ac21e
SHA2568955098f1b1c57da1df80af66914bb7f9eee468ca8199e23a0415e1bbe8ad339
SHA51211687ab89f3f837f7e7b838cf15d80bb1614386072263f8a65dee4508a96241b8ba009edd1d87d02076048fa692c332b40804c3db4705c547bced5ad3e95416a
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
93KB
MD518629444d2e20b32df0c82d841a62932
SHA1ec89a43abc1042e3633fc2fced4e5b124e1ac21e
SHA2568955098f1b1c57da1df80af66914bb7f9eee468ca8199e23a0415e1bbe8ad339
SHA51211687ab89f3f837f7e7b838cf15d80bb1614386072263f8a65dee4508a96241b8ba009edd1d87d02076048fa692c332b40804c3db4705c547bced5ad3e95416a
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD5399f38fdf7aaf217d0b32896af9f298c
SHA1db37bfb5bd821b9068587df50d57b38f0287d760
SHA256c4814a00866e93627816b8987550d30010a862936285a5ceb656f06b6d285b46
SHA5120130418d2e5bbe23e1a796ea11be0abdd639ae4ab36eae64ab0404984c1b0928a95fb14ee5444b0681e6e0eb23911fe3ac619137ed0241ae60cf1d8c8672d179
-
memory/4272-16-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB
-
memory/4272-14-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB
-
memory/4272-15-0x00000000011F0000-0x0000000001200000-memory.dmpFilesize
64KB
-
memory/4272-43-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB
-
memory/4272-45-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB
-
memory/4272-44-0x00000000011F0000-0x0000000001200000-memory.dmpFilesize
64KB
-
memory/4596-2-0x0000000001170000-0x0000000001180000-memory.dmpFilesize
64KB
-
memory/4596-13-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB
-
memory/4596-0-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB
-
memory/4596-1-0x0000000075530000-0x0000000075AE1000-memory.dmpFilesize
5.7MB