Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
07-12-2023 19:21
Behavioral task
behavioral1
Sample
ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe
Resource
win10v2004-20231127-en
General
-
Target
ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe
-
Size
37KB
-
MD5
47e3f3358fbf1ee79fbed6e4f22d28e8
-
SHA1
1ff51a2a2c9ef6b5c21824f77fd44b262e7e42e1
-
SHA256
ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577a
-
SHA512
0b35e8198bc70d9ead4a96fcf9d14a67562216c38855ac7f4f6d23577da874ddf543eccd5ae28180c02063f370c62cf1ad3a4b1a8af89ec720cea68a368aaf48
-
SSDEEP
384:3QKvEiTbHvpWNcZ0y8f7CTvvrILkCwE3rAF+rMRTyN/0L+EcoinblneHQM3epzXJ:gKXTZ38f7CTv8FwKrM+rMRa8NuzFt
Malware Config
Extracted
njrat
im523
HacKed
0.tcp.eu.ngrok.io:16921
8be032421617ac901feeb88dde9830e6
-
reg_key
8be032421617ac901feeb88dde9830e6
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
server.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8be032421617ac901feeb88dde9830e6.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8be032421617ac901feeb88dde9830e6.exe server.exe -
Executes dropped EXE 1 IoCs
Processes:
server.exepid process 2092 server.exe -
Loads dropped DLL 1 IoCs
Processes:
ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exepid process 1144 ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
server.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\8be032421617ac901feeb88dde9830e6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8be032421617ac901feeb88dde9830e6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
server.exepid process 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe 2092 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
server.exepid process 2092 server.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
server.exedescription pid process Token: SeDebugPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe Token: 33 2092 server.exe Token: SeIncBasePriorityPrivilege 2092 server.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exeserver.exedescription pid process target process PID 1144 wrote to memory of 2092 1144 ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe server.exe PID 1144 wrote to memory of 2092 1144 ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe server.exe PID 1144 wrote to memory of 2092 1144 ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe server.exe PID 1144 wrote to memory of 2092 1144 ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe server.exe PID 2092 wrote to memory of 2796 2092 server.exe netsh.exe PID 2092 wrote to memory of 2796 2092 server.exe netsh.exe PID 2092 wrote to memory of 2796 2092 server.exe netsh.exe PID 2092 wrote to memory of 2796 2092 server.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe"C:\Users\Admin\AppData\Local\Temp\ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577aexe.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
37KB
MD547e3f3358fbf1ee79fbed6e4f22d28e8
SHA11ff51a2a2c9ef6b5c21824f77fd44b262e7e42e1
SHA256ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577a
SHA5120b35e8198bc70d9ead4a96fcf9d14a67562216c38855ac7f4f6d23577da874ddf543eccd5ae28180c02063f370c62cf1ad3a4b1a8af89ec720cea68a368aaf48
-
C:\Users\Admin\AppData\Local\Temp\server.exeFilesize
37KB
MD547e3f3358fbf1ee79fbed6e4f22d28e8
SHA11ff51a2a2c9ef6b5c21824f77fd44b262e7e42e1
SHA256ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577a
SHA5120b35e8198bc70d9ead4a96fcf9d14a67562216c38855ac7f4f6d23577da874ddf543eccd5ae28180c02063f370c62cf1ad3a4b1a8af89ec720cea68a368aaf48
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8be032421617ac901feeb88dde9830e6.exeFilesize
37KB
MD547e3f3358fbf1ee79fbed6e4f22d28e8
SHA11ff51a2a2c9ef6b5c21824f77fd44b262e7e42e1
SHA256ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577a
SHA5120b35e8198bc70d9ead4a96fcf9d14a67562216c38855ac7f4f6d23577da874ddf543eccd5ae28180c02063f370c62cf1ad3a4b1a8af89ec720cea68a368aaf48
-
\Users\Admin\AppData\Local\Temp\server.exeFilesize
37KB
MD547e3f3358fbf1ee79fbed6e4f22d28e8
SHA11ff51a2a2c9ef6b5c21824f77fd44b262e7e42e1
SHA256ce408e126def4dab38a7a260d4775111b140154cfc5abb1b6a0f397884e0577a
SHA5120b35e8198bc70d9ead4a96fcf9d14a67562216c38855ac7f4f6d23577da874ddf543eccd5ae28180c02063f370c62cf1ad3a4b1a8af89ec720cea68a368aaf48
-
memory/1144-0-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/1144-2-0x0000000001F20000-0x0000000001F60000-memory.dmpFilesize
256KB
-
memory/1144-1-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/1144-12-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2092-10-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB
-
memory/2092-11-0x0000000002130000-0x0000000002170000-memory.dmpFilesize
256KB
-
memory/2092-14-0x00000000747D0000-0x0000000074D7B000-memory.dmpFilesize
5.7MB