Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
07-12-2023 10:27
Behavioral task
behavioral1
Sample
5ffc76cfa5ade6017fff6b56c343f718.exe
Resource
win7-20231201-en
General
-
Target
5ffc76cfa5ade6017fff6b56c343f718.exe
-
Size
93KB
-
MD5
5ffc76cfa5ade6017fff6b56c343f718
-
SHA1
ac5b3889af5e488c26102b1b886c00ae0b15aebc
-
SHA256
26b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
-
SHA512
9be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
SSDEEP
768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
6.tcp.eu.ngrok.io:13150
eafe3130af183c86c36221806d0c196a
-
reg_key
eafe3130af183c86c36221806d0c196a
-
splitter
|'|'|
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 6 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 1932 netsh.exe 1888 netsh.exe 2664 netsh.exe 2688 netsh.exe 2728 netsh.exe 2888 netsh.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2872 svchost.exe -
Drops startup file 3 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 2872 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exepid process 1668 5ffc76cfa5ade6017fff6b56c343f718.exe 1668 5ffc76cfa5ade6017fff6b56c343f718.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription ioc process File created C:\Windows\SysWOW64\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Windows\SysWOW64\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Windows\SysWOW64\Explower.exe svchost.exe -
Drops file in Program Files directory 3 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription ioc process File created C:\Program Files (x86)\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Program Files (x86)\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Program Files (x86)\Explower.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe 2872 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exepid process 1668 5ffc76cfa5ade6017fff6b56c343f718.exe 2872 svchost.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe Token: 33 2872 svchost.exe Token: SeIncBasePriorityPrivilege 2872 svchost.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription pid process target process PID 1668 wrote to memory of 2664 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2664 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2664 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2664 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2728 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2728 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2728 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2728 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2688 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2688 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2688 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2688 1668 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1668 wrote to memory of 2872 1668 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 1668 wrote to memory of 2872 1668 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 1668 wrote to memory of 2872 1668 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 1668 wrote to memory of 2872 1668 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 2872 wrote to memory of 2888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 2888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 2888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 2888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1888 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1932 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1932 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1932 2872 svchost.exe netsh.exe PID 2872 wrote to memory of 1932 2872 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe"C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe" "5ffc76cfa5ade6017fff6b56c343f718.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe" "5ffc76cfa5ade6017fff6b56c343f718.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe"2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Temp\melt.txtFilesize
70B
MD5453a9e2b9ce43091d6d2056beb11a9ff
SHA18c2b4430b6e57d474ab105ba2102af1b63d8bbe6
SHA256ab1363162bd66e8b673f74cedb9aec9de51bb18b9d0740fdb7784f6160d2704c
SHA512821b53b11746879811b30c08b8f65421134cb7d44a6001f9b11f1d5c0c54fc78be8c754028b9068c7a86282929823e324b73349aec72200d7143925e697e8388
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD5fba73ce50d8cfb469ec29a2333b22a85
SHA14b7b6dfb36af4a016301dc065870dd0829db0a55
SHA25656ae4e1144656432194c610e366fb556f7401a9993e75c0007f46397a5ddfa03
SHA512b620d99e15c25e970a09738d14b493b2345ec1eb48737e2983565666a3c052d235712db01a110c9948dc00d62a14fcccf43ccc295f993d673334dc88497c77c7
-
C:\Users\Admin\Desktop\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\Documents\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\Favorites\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Windows\SysWOW64\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
memory/1668-0-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB
-
memory/1668-34-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB
-
memory/1668-2-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB
-
memory/1668-1-0x00000000006A0000-0x00000000006E0000-memory.dmpFilesize
256KB
-
memory/2872-36-0x00000000001B0000-0x00000000001F0000-memory.dmpFilesize
256KB
-
memory/2872-37-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB
-
memory/2872-35-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB
-
memory/2872-69-0x0000000074610000-0x0000000074BBB000-memory.dmpFilesize
5.7MB