Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 10:27
Behavioral task
behavioral1
Sample
5ffc76cfa5ade6017fff6b56c343f718.exe
Resource
win7-20231201-en
General
-
Target
5ffc76cfa5ade6017fff6b56c343f718.exe
-
Size
93KB
-
MD5
5ffc76cfa5ade6017fff6b56c343f718
-
SHA1
ac5b3889af5e488c26102b1b886c00ae0b15aebc
-
SHA256
26b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
-
SHA512
9be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
SSDEEP
768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
Malware Config
Extracted
njrat
0.7d
HacKed
hakim32.ddns.net:2000
6.tcp.eu.ngrok.io:13150
eafe3130af183c86c36221806d0c196a
-
reg_key
eafe3130af183c86c36221806d0c196a
-
splitter
|'|'|
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs 6 IoCs
Processes:
netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exepid process 5100 netsh.exe 216 netsh.exe 3568 netsh.exe 5104 netsh.exe 5056 netsh.exe 1120 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation 5ffc76cfa5ade6017fff6b56c343f718.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3400 svchost.exe -
Drops startup file 3 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3400 svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
Processes:
svchost.exe5ffc76cfa5ade6017fff6b56c343f718.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Explower.exe svchost.exe File created C:\Windows\SysWOW64\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Windows\SysWOW64\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe -
Drops file in Program Files directory 3 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription ioc process File created C:\Program Files (x86)\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Program Files (x86)\Explower.exe 5ffc76cfa5ade6017fff6b56c343f718.exe File opened for modification C:\Program Files (x86)\Explower.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exepid process 1360 5ffc76cfa5ade6017fff6b56c343f718.exe 1360 5ffc76cfa5ade6017fff6b56c343f718.exe 1360 5ffc76cfa5ade6017fff6b56c343f718.exe 1360 5ffc76cfa5ade6017fff6b56c343f718.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exepid process 1360 5ffc76cfa5ade6017fff6b56c343f718.exe 3400 svchost.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription pid process Token: SeDebugPrivilege 1360 5ffc76cfa5ade6017fff6b56c343f718.exe Token: SeDebugPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe Token: 33 3400 svchost.exe Token: SeIncBasePriorityPrivilege 3400 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
5ffc76cfa5ade6017fff6b56c343f718.exesvchost.exedescription pid process target process PID 1360 wrote to memory of 5100 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 5100 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 5100 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 3568 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 3568 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 3568 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 216 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 216 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 216 1360 5ffc76cfa5ade6017fff6b56c343f718.exe netsh.exe PID 1360 wrote to memory of 3400 1360 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 1360 wrote to memory of 3400 1360 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 1360 wrote to memory of 3400 1360 5ffc76cfa5ade6017fff6b56c343f718.exe svchost.exe PID 3400 wrote to memory of 5104 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 5104 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 5104 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 1120 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 1120 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 1120 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 5056 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 5056 3400 svchost.exe netsh.exe PID 3400 wrote to memory of 5056 3400 svchost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe"C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe"1⤵
- Checks computer location settings
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe" "5ffc76cfa5ade6017fff6b56c343f718.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe" "5ffc76cfa5ade6017fff6b56c343f718.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\5ffc76cfa5ade6017fff6b56c343f718.exe"2⤵
- Modifies Windows Firewall
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"2⤵
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe"3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Local\Temp\melt.txtFilesize
70B
MD5453a9e2b9ce43091d6d2056beb11a9ff
SHA18c2b4430b6e57d474ab105ba2102af1b63d8bbe6
SHA256ab1363162bd66e8b673f74cedb9aec9de51bb18b9d0740fdb7784f6160d2704c
SHA512821b53b11746879811b30c08b8f65421134cb7d44a6001f9b11f1d5c0c54fc78be8c754028b9068c7a86282929823e324b73349aec72200d7143925e697e8388
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\AppData\Roaming\appFilesize
4B
MD5fba73ce50d8cfb469ec29a2333b22a85
SHA14b7b6dfb36af4a016301dc065870dd0829db0a55
SHA25656ae4e1144656432194c610e366fb556f7401a9993e75c0007f46397a5ddfa03
SHA512b620d99e15c25e970a09738d14b493b2345ec1eb48737e2983565666a3c052d235712db01a110c9948dc00d62a14fcccf43ccc295f993d673334dc88497c77c7
-
C:\Users\Admin\Desktop\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\Documents\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Users\Admin\Favorites\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
C:\Windows\SysWOW64\Explower.exeFilesize
93KB
MD55ffc76cfa5ade6017fff6b56c343f718
SHA1ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA25626b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA5129be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
-
memory/1360-0-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/1360-33-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/1360-2-0x0000000001A10000-0x0000000001A20000-memory.dmpFilesize
64KB
-
memory/1360-1-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/3400-35-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/3400-34-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB
-
memory/3400-67-0x0000000074C00000-0x00000000751B1000-memory.dmpFilesize
5.7MB