Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2023 04:47
Static task
static1
Behavioral task
behavioral1
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win10v2004-20231215-en
General
-
Target
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
-
Size
104KB
-
MD5
a3ff56835b4bd0e80f6e95fbfc741a8e
-
SHA1
8af2b8e66107890df87a3c6ee9a5712228f95d8a
-
SHA256
ee9fd41093ef9d4e21a78ab987df6ad42a6fa5dcea7ebd9c5ff1e1f388720d8e
-
SHA512
1dbc80bccb87b4f1330a783fb4c2c7840cec6d9c280c261c8df2d8bdd4188ca1e779665f00cb35440660f70e95a06f178387aa113803ef0581dd2d658694107b
-
SSDEEP
1536:+eS3Yzxx6ZTD9Um9UoCONGAho+nuzGHRbVV3jEbgkxpPNOf5uze3S:+eS3Yzxx6R63ahJn9RStUYzeC
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
system
4.tcp.ngrok.io:14964
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ZbECSrTmBt = "C:\\Users\\Admin\\AppData\\Roaming\\LzYAJeGoJn\\jHHCSpKiYF.exe" a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 3652 set thread context of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exepid process 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exepid process 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exea3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process Token: SeDebugPrivilege 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeDebugPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 3660 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 3652 wrote to memory of 1120 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 1120 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 1120 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 3652 wrote to memory of 3660 3652 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a3ff56835b4bd0e80f6e95fbfc741a8e.exe.logFilesize
507B
MD58cf94b5356be60247d331660005941ec
SHA1fdedb361f40f22cb6a086c808fc0056d4e421131
SHA25652a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0
SHA512b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651
-
memory/3652-4-0x00000000051D0000-0x0000000005262000-memory.dmpFilesize
584KB
-
memory/3652-2-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/3652-0-0x0000000000710000-0x0000000000730000-memory.dmpFilesize
128KB
-
memory/3652-5-0x0000000005270000-0x000000000530C000-memory.dmpFilesize
624KB
-
memory/3652-7-0x00000000050D0000-0x00000000050DA000-memory.dmpFilesize
40KB
-
memory/3652-16-0x00000000751C0000-0x0000000075970000-memory.dmpFilesize
7.7MB
-
memory/3652-3-0x0000000005780000-0x0000000005D24000-memory.dmpFilesize
5.6MB
-
memory/3652-1-0x00000000751C0000-0x0000000075970000-memory.dmpFilesize
7.7MB
-
memory/3660-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3660-11-0x00000000751C0000-0x0000000075970000-memory.dmpFilesize
7.7MB
-
memory/3660-13-0x00000000055A0000-0x00000000055AA000-memory.dmpFilesize
40KB
-
memory/3660-14-0x0000000005910000-0x0000000005976000-memory.dmpFilesize
408KB
-
memory/3660-15-0x0000000006930000-0x0000000006948000-memory.dmpFilesize
96KB
-
memory/3660-12-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB
-
memory/3660-17-0x00000000751C0000-0x0000000075970000-memory.dmpFilesize
7.7MB
-
memory/3660-18-0x00000000055C0000-0x00000000055D0000-memory.dmpFilesize
64KB