Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
06-12-2023 08:58
Static task
static1
Behavioral task
behavioral1
Sample
adf116f81eaab92d114cdd28a23adf59.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
adf116f81eaab92d114cdd28a23adf59.exe
Resource
win10v2004-20231130-en
General
-
Target
adf116f81eaab92d114cdd28a23adf59.exe
-
Size
39KB
-
MD5
adf116f81eaab92d114cdd28a23adf59
-
SHA1
84c921f3a47af6281d1ccba44b45e28436d251cf
-
SHA256
e3572aa1858c4768c3a3985cf00d7e5f51fff72630f7c887149bbe910797f29f
-
SHA512
2c00cd2e8527028002d1c15bda78bf042efe96366bf08568722ed452816d013680dc9f8bd0da6d0f863db0d8280eb579b0b8732d3256df1d43b696da87db6c2d
-
SSDEEP
768:VvAh0QJOYXCg3R5btZ4r5w74Ei1vY+j0TqnihnFY8Pjw1QB:ih7OUx3R5by5w0EA90TqnsnFY87w1QB
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:6522
Client.exe
-
reg_key
Client.exe
-
splitter
|Ghost|
Signatures
-
Drops startup file 3 IoCs
Processes:
Client.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url Client.exe -
Executes dropped EXE 1 IoCs
Processes:
Client.exepid process 2652 Client.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Client.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1502336823-1680518048-858510903-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
Client.exedescription pid process Token: SeDebugPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe Token: 33 2652 Client.exe Token: SeIncBasePriorityPrivilege 2652 Client.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
adf116f81eaab92d114cdd28a23adf59.exedescription pid process target process PID 2340 wrote to memory of 2652 2340 adf116f81eaab92d114cdd28a23adf59.exe Client.exe PID 2340 wrote to memory of 2652 2340 adf116f81eaab92d114cdd28a23adf59.exe Client.exe PID 2340 wrote to memory of 2652 2340 adf116f81eaab92d114cdd28a23adf59.exe Client.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adf116f81eaab92d114cdd28a23adf59.exe"C:\Users\Admin\AppData\Local\Temp\adf116f81eaab92d114cdd28a23adf59.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Client.exeFilesize
39KB
MD5adf116f81eaab92d114cdd28a23adf59
SHA184c921f3a47af6281d1ccba44b45e28436d251cf
SHA256e3572aa1858c4768c3a3985cf00d7e5f51fff72630f7c887149bbe910797f29f
SHA5122c00cd2e8527028002d1c15bda78bf042efe96366bf08568722ed452816d013680dc9f8bd0da6d0f863db0d8280eb579b0b8732d3256df1d43b696da87db6c2d
-
C:\Users\Admin\AppData\Local\Temp\Client.exeFilesize
39KB
MD5adf116f81eaab92d114cdd28a23adf59
SHA184c921f3a47af6281d1ccba44b45e28436d251cf
SHA256e3572aa1858c4768c3a3985cf00d7e5f51fff72630f7c887149bbe910797f29f
SHA5122c00cd2e8527028002d1c15bda78bf042efe96366bf08568722ed452816d013680dc9f8bd0da6d0f863db0d8280eb579b0b8732d3256df1d43b696da87db6c2d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exeFilesize
39KB
MD5adf116f81eaab92d114cdd28a23adf59
SHA184c921f3a47af6281d1ccba44b45e28436d251cf
SHA256e3572aa1858c4768c3a3985cf00d7e5f51fff72630f7c887149bbe910797f29f
SHA5122c00cd2e8527028002d1c15bda78bf042efe96366bf08568722ed452816d013680dc9f8bd0da6d0f863db0d8280eb579b0b8732d3256df1d43b696da87db6c2d
-
memory/2340-2-0x0000000001DD0000-0x0000000001E50000-memory.dmpFilesize
512KB
-
memory/2340-1-0x000007FEF61E0000-0x000007FEF6B7D000-memory.dmpFilesize
9.6MB
-
memory/2340-3-0x000007FEF61E0000-0x000007FEF6B7D000-memory.dmpFilesize
9.6MB
-
memory/2340-0-0x0000000000510000-0x0000000000526000-memory.dmpFilesize
88KB
-
memory/2340-11-0x000007FEF61E0000-0x000007FEF6B7D000-memory.dmpFilesize
9.6MB
-
memory/2652-9-0x000007FEF61E0000-0x000007FEF6B7D000-memory.dmpFilesize
9.6MB
-
memory/2652-12-0x000007FEF61E0000-0x000007FEF6B7D000-memory.dmpFilesize
9.6MB
-
memory/2652-10-0x0000000000A50000-0x0000000000AD0000-memory.dmpFilesize
512KB
-
memory/2652-16-0x0000000000A50000-0x0000000000AD0000-memory.dmpFilesize
512KB
-
memory/2652-17-0x000007FEF61E0000-0x000007FEF6B7D000-memory.dmpFilesize
9.6MB
-
memory/2652-18-0x0000000000A50000-0x0000000000AD0000-memory.dmpFilesize
512KB