Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 13:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a37305b16f4f9a616a44f59d749d1bad.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
a37305b16f4f9a616a44f59d749d1bad.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
a37305b16f4f9a616a44f59d749d1bad.exe
-
Size
1.1MB
-
MD5
a37305b16f4f9a616a44f59d749d1bad
-
SHA1
971c8a3b26f94291cb3f97cc86c0158d27fb700a
-
SHA256
2825f60e7406d86bb5cbd60cb8239ef2a694f2defa6b6445df4a1a4549e17978
-
SHA512
b39c378bb471307a962c09670805793e0222d819084c4b4933c88066b0f6bdb6700fff3f22d05121e53395c97a330b1f82db2117952585a2c4080f3f58856fc9
-
SSDEEP
24576:aCH5N4C79zawzKkZtlmhDi25VmTI26ee3S4Q45cjdPJhTD9qDyQH:VH5B79ewtDlm825VmES85cDhTBydH
Score
10/10
Malware Config
Extracted
Family
njrat
Version
im523
Botnet
windows
C2
178.33.93.88:2353
Mutex
78a76c8b22b24e8a23742c673717db60
Attributes
-
reg_key
78a76c8b22b24e8a23742c673717db60
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3720 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation a37305b16f4f9a616a44f59d749d1bad.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\78a76c8b22b24e8a23742c673717db60.exe windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\78a76c8b22b24e8a23742c673717db60.exe windows.exe -
Executes dropped EXE 1 IoCs
pid Process 2220 windows.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\78a76c8b22b24e8a23742c673717db60 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\78a76c8b22b24e8a23742c673717db60 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 4756 a37305b16f4f9a616a44f59d749d1bad.exe 4756 a37305b16f4f9a616a44f59d749d1bad.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe 2220 windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2220 windows.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe Token: 33 2220 windows.exe Token: SeIncBasePriorityPrivilege 2220 windows.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4756 a37305b16f4f9a616a44f59d749d1bad.exe 2220 windows.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2220 4756 a37305b16f4f9a616a44f59d749d1bad.exe 93 PID 4756 wrote to memory of 2220 4756 a37305b16f4f9a616a44f59d749d1bad.exe 93 PID 4756 wrote to memory of 2220 4756 a37305b16f4f9a616a44f59d749d1bad.exe 93 PID 2220 wrote to memory of 3720 2220 windows.exe 94 PID 2220 wrote to memory of 3720 2220 windows.exe 94 PID 2220 wrote to memory of 3720 2220 windows.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\a37305b16f4f9a616a44f59d749d1bad.exe"C:\Users\Admin\AppData\Local\Temp\a37305b16f4f9a616a44f59d749d1bad.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:3720
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a37305b16f4f9a616a44f59d749d1bad
SHA1971c8a3b26f94291cb3f97cc86c0158d27fb700a
SHA2562825f60e7406d86bb5cbd60cb8239ef2a694f2defa6b6445df4a1a4549e17978
SHA512b39c378bb471307a962c09670805793e0222d819084c4b4933c88066b0f6bdb6700fff3f22d05121e53395c97a330b1f82db2117952585a2c4080f3f58856fc9