Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27-12-2023 04:47
Static task
static1
Behavioral task
behavioral1
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win10v2004-20231215-en
General
-
Target
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
-
Size
104KB
-
MD5
a3ff56835b4bd0e80f6e95fbfc741a8e
-
SHA1
8af2b8e66107890df87a3c6ee9a5712228f95d8a
-
SHA256
ee9fd41093ef9d4e21a78ab987df6ad42a6fa5dcea7ebd9c5ff1e1f388720d8e
-
SHA512
1dbc80bccb87b4f1330a783fb4c2c7840cec6d9c280c261c8df2d8bdd4188ca1e779665f00cb35440660f70e95a06f178387aa113803ef0581dd2d658694107b
-
SSDEEP
1536:+eS3Yzxx6ZTD9Um9UoCONGAho+nuzGHRbVV3jEbgkxpPNOf5uze3S:+eS3Yzxx6R63ahJn9RStUYzeC
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
system
4.tcp.ngrok.io:14964
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ZbECSrTmBt = "C:\\Users\\Admin\\AppData\\Roaming\\LzYAJeGoJn\\jHHCSpKiYF.exe" a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 848 set thread context of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exepid process 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process Token: SeDebugPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 2444 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 848 wrote to memory of 2444 848 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-0-0x00000000011C0000-0x00000000011E0000-memory.dmpFilesize
128KB
-
memory/848-1-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/848-2-0x00000000049E0000-0x0000000004A20000-memory.dmpFilesize
256KB
-
memory/848-4-0x0000000000430000-0x000000000043A000-memory.dmpFilesize
40KB
-
memory/848-13-0x0000000074B90000-0x000000007527E000-memory.dmpFilesize
6.9MB
-
memory/2444-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2444-7-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-6-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-11-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-14-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2444-17-0x00000000744A0000-0x0000000074B8E000-memory.dmpFilesize
6.9MB
-
memory/2444-18-0x0000000005040000-0x0000000005080000-memory.dmpFilesize
256KB
-
memory/2444-19-0x00000000744A0000-0x0000000074B8E000-memory.dmpFilesize
6.9MB
-
memory/2444-20-0x0000000005040000-0x0000000005080000-memory.dmpFilesize
256KB