Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2023 18:55
Behavioral task
behavioral1
Sample
1e28904cacc4be6d50c03fb71171d9a7.exe
Resource
win7-20231129-en
General
-
Target
1e28904cacc4be6d50c03fb71171d9a7.exe
-
Size
43KB
-
MD5
1e28904cacc4be6d50c03fb71171d9a7
-
SHA1
1915e4f915e7e06df9efe1619921ae7960f1cbb2
-
SHA256
e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367
-
SHA512
5d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0
-
SSDEEP
384:CZy7polQ5GoyyNrl3cXmICEDXH/zIIij+ZsNO3PlpJKkkjh/TzF7pWnZ/greT0pO:wBmolyNrB4LRxuXQ/o0/+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.eu.ngrok.io:15505
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1e28904cacc4be6d50c03fb71171d9a7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\International\Geo\Nation 1e28904cacc4be6d50c03fb71171d9a7.exe -
Executes dropped EXE 1 IoCs
Processes:
Dllhost.exepid process 1508 Dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
1e28904cacc4be6d50c03fb71171d9a7.exeDllhost.exepid process 676 1e28904cacc4be6d50c03fb71171d9a7.exe 1508 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
Dllhost.exedescription pid process Token: SeDebugPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe Token: 33 1508 Dllhost.exe Token: SeIncBasePriorityPrivilege 1508 Dllhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1e28904cacc4be6d50c03fb71171d9a7.exedescription pid process target process PID 676 wrote to memory of 1508 676 1e28904cacc4be6d50c03fb71171d9a7.exe Dllhost.exe PID 676 wrote to memory of 1508 676 1e28904cacc4be6d50c03fb71171d9a7.exe Dllhost.exe PID 676 wrote to memory of 1508 676 1e28904cacc4be6d50c03fb71171d9a7.exe Dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e28904cacc4be6d50c03fb71171d9a7.exe"C:\Users\Admin\AppData\Local\Temp\1e28904cacc4be6d50c03fb71171d9a7.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Dllhost.exe"C:\Users\Admin\AppData\Roaming\Dllhost.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD51e28904cacc4be6d50c03fb71171d9a7
SHA11915e4f915e7e06df9efe1619921ae7960f1cbb2
SHA256e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367
SHA5125d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD51e28904cacc4be6d50c03fb71171d9a7
SHA11915e4f915e7e06df9efe1619921ae7960f1cbb2
SHA256e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367
SHA5125d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0
-
C:\Users\Admin\AppData\Roaming\Dllhost.exeFilesize
43KB
MD51e28904cacc4be6d50c03fb71171d9a7
SHA11915e4f915e7e06df9efe1619921ae7960f1cbb2
SHA256e50bc61300de2d3af137bcd1a5728219fac7e7635bb0ab6050ed4fa380038367
SHA5125d3ac9e12ad81ea89d62717ebc65d9a1f9dab173b956741070cca4c551c675e6c91918928835817b8b082632e5f4d7d98e64949d54b8404188983efc044f3df0
-
memory/676-1-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB
-
memory/676-2-0x0000000005580000-0x000000000561C000-memory.dmpFilesize
624KB
-
memory/676-3-0x0000000005720000-0x0000000005730000-memory.dmpFilesize
64KB
-
memory/676-4-0x0000000005DE0000-0x0000000006384000-memory.dmpFilesize
5.6MB
-
memory/676-5-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/676-16-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB
-
memory/676-0-0x0000000000C70000-0x0000000000C82000-memory.dmpFilesize
72KB
-
memory/1508-17-0x0000000005780000-0x0000000005790000-memory.dmpFilesize
64KB
-
memory/1508-15-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB
-
memory/1508-18-0x0000000005900000-0x000000000590A000-memory.dmpFilesize
40KB
-
memory/1508-19-0x0000000005B40000-0x0000000005BA6000-memory.dmpFilesize
408KB
-
memory/1508-20-0x0000000006A70000-0x0000000006A88000-memory.dmpFilesize
96KB
-
memory/1508-21-0x0000000075370000-0x0000000075B20000-memory.dmpFilesize
7.7MB