Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 16:52
Static task
static1
Behavioral task
behavioral1
Sample
62457e5d7d72b9d2a3dc94404023b8e8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
62457e5d7d72b9d2a3dc94404023b8e8.exe
Resource
win10v2004-20231215-en
General
-
Target
62457e5d7d72b9d2a3dc94404023b8e8.exe
-
Size
33KB
-
MD5
62457e5d7d72b9d2a3dc94404023b8e8
-
SHA1
a0fd127f66696531e9e1fc59d4d8c88c86d14e02
-
SHA256
2b8acd41c61581c4a77c399cf5fe9ba7104cadd2f8cdc6a331536b618b21cbf3
-
SHA512
7a58ae906ec1b7375e14aa0af8c0e1d976b2ee1303e0e7e0f2728152ade4be6b6dbdb2db32137c142d0892b3616689ab31c96a721fb89ff49d6178ba854ecb7b
-
SSDEEP
768:VvTJHptt6VwxbpCrFJyrZXtFS3ypqCFLrv:t1pKabqFJyhfS3cqCFH
Malware Config
Extracted
njrat
0.7d
HacKed
girafa2002otaku.ddns.net:1177
Windows Update
-
reg_key
Windows Update
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
62457e5d7d72b9d2a3dc94404023b8e8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 62457e5d7d72b9d2a3dc94404023b8e8.exe -
Drops startup file 2 IoCs
Processes:
explorer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe explorer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.exe explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1928 explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe\" .." explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe\" .." explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
explorer.exedescription pid process Token: SeDebugPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe Token: 33 1928 explorer.exe Token: SeIncBasePriorityPrivilege 1928 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
62457e5d7d72b9d2a3dc94404023b8e8.exeexplorer.exedescription pid process target process PID 1796 wrote to memory of 1928 1796 62457e5d7d72b9d2a3dc94404023b8e8.exe explorer.exe PID 1796 wrote to memory of 1928 1796 62457e5d7d72b9d2a3dc94404023b8e8.exe explorer.exe PID 1928 wrote to memory of 4052 1928 explorer.exe netsh.exe PID 1928 wrote to memory of 4052 1928 explorer.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62457e5d7d72b9d2a3dc94404023b8e8.exe"C:\Users\Admin\AppData\Local\Temp\62457e5d7d72b9d2a3dc94404023b8e8.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer.exe"C:\Users\Admin\AppData\Roaming\explorer.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\explorer.exe" "explorer.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\explorer.exeFilesize
33KB
MD562457e5d7d72b9d2a3dc94404023b8e8
SHA1a0fd127f66696531e9e1fc59d4d8c88c86d14e02
SHA2562b8acd41c61581c4a77c399cf5fe9ba7104cadd2f8cdc6a331536b618b21cbf3
SHA5127a58ae906ec1b7375e14aa0af8c0e1d976b2ee1303e0e7e0f2728152ade4be6b6dbdb2db32137c142d0892b3616689ab31c96a721fb89ff49d6178ba854ecb7b
-
memory/1796-0-0x00007FFC28600000-0x00007FFC28FA1000-memory.dmpFilesize
9.6MB
-
memory/1796-1-0x00007FFC28600000-0x00007FFC28FA1000-memory.dmpFilesize
9.6MB
-
memory/1796-2-0x00000000012D0000-0x00000000012E0000-memory.dmpFilesize
64KB
-
memory/1796-3-0x000000001BB70000-0x000000001C03E000-memory.dmpFilesize
4.8MB
-
memory/1796-4-0x0000000001140000-0x0000000001156000-memory.dmpFilesize
88KB
-
memory/1796-5-0x000000001C100000-0x000000001C1A6000-memory.dmpFilesize
664KB
-
memory/1796-15-0x00007FFC28600000-0x00007FFC28FA1000-memory.dmpFilesize
9.6MB
-
memory/1928-16-0x00007FFC28600000-0x00007FFC28FA1000-memory.dmpFilesize
9.6MB
-
memory/1928-17-0x0000000000870000-0x0000000000880000-memory.dmpFilesize
64KB
-
memory/1928-18-0x000000001AF80000-0x000000001AF96000-memory.dmpFilesize
88KB
-
memory/1928-19-0x00007FFC28600000-0x00007FFC28FA1000-memory.dmpFilesize
9.6MB
-
memory/1928-21-0x000000001BD60000-0x000000001BDFC000-memory.dmpFilesize
624KB
-
memory/1928-22-0x000000001AFA0000-0x000000001AFA8000-memory.dmpFilesize
32KB
-
memory/1928-23-0x0000000000870000-0x0000000000880000-memory.dmpFilesize
64KB
-
memory/1928-24-0x00007FFC28600000-0x00007FFC28FA1000-memory.dmpFilesize
9.6MB
-
memory/1928-25-0x0000000000870000-0x0000000000880000-memory.dmpFilesize
64KB
-
memory/1928-26-0x0000000000870000-0x0000000000880000-memory.dmpFilesize
64KB