Analysis
-
max time kernel
70s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 18:06
Behavioral task
behavioral1
Sample
6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe
Resource
win10v2004-20231215-en
General
-
Target
6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe
-
Size
23KB
-
MD5
56b932581ca03686ad499fad655f6657
-
SHA1
4a5b99528438aa27cd2608f7be56bfd314d39f26
-
SHA256
6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588
-
SHA512
e04c20a01cef5987340e6f40da5e8aeaf52952ccbe10b1eb538a612bba75b45c91988d8014b2eb42ed742c29e5d0a152f969e1b9656846d2f9117faae9e7197c
-
SSDEEP
384:RoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZdfZU:G7O89p2rRpcnuMhU
Malware Config
Extracted
njrat
0.7d
HHHXXX
black101.ddns.net:1177
c7c947d665980e197b736d98adf01cc0
-
reg_key
c7c947d665980e197b736d98adf01cc0
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
win33.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7c947d665980e197b736d98adf01cc0.exe win33.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c7c947d665980e197b736d98adf01cc0.exe win33.exe -
Executes dropped EXE 1 IoCs
Processes:
win33.exepid process 2692 win33.exe -
Loads dropped DLL 1 IoCs
Processes:
6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exepid process 2452 6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
win33.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\c7c947d665980e197b736d98adf01cc0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\win33.exe\" .." win33.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\c7c947d665980e197b736d98adf01cc0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\win33.exe\" .." win33.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
win33.exedescription pid process Token: SeDebugPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe Token: 33 2692 win33.exe Token: SeIncBasePriorityPrivilege 2692 win33.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exewin33.exedescription pid process target process PID 2452 wrote to memory of 2692 2452 6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe win33.exe PID 2452 wrote to memory of 2692 2452 6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe win33.exe PID 2452 wrote to memory of 2692 2452 6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe win33.exe PID 2452 wrote to memory of 2692 2452 6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe win33.exe PID 2692 wrote to memory of 2816 2692 win33.exe netsh.exe PID 2692 wrote to memory of 2816 2692 win33.exe netsh.exe PID 2692 wrote to memory of 2816 2692 win33.exe netsh.exe PID 2692 wrote to memory of 2816 2692 win33.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe"C:\Users\Admin\AppData\Local\Temp\6e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\win33.exe"C:\Users\Admin\AppData\Local\Temp\win33.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\win33.exe" "win33.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2816
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2588
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2236
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\win33.exeFilesize
23KB
MD556b932581ca03686ad499fad655f6657
SHA14a5b99528438aa27cd2608f7be56bfd314d39f26
SHA2566e323bddb6f10b049428e50b9cf4da9f047829e83aa32e00bb2a7f4dc2a5e588
SHA512e04c20a01cef5987340e6f40da5e8aeaf52952ccbe10b1eb538a612bba75b45c91988d8014b2eb42ed742c29e5d0a152f969e1b9656846d2f9117faae9e7197c
-
memory/2452-0-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/2452-1-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/2452-2-0x00000000008E0000-0x0000000000920000-memory.dmpFilesize
256KB
-
memory/2452-10-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/2692-12-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/2692-11-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB
-
memory/2692-15-0x00000000001F0000-0x0000000000230000-memory.dmpFilesize
256KB
-
memory/2692-14-0x0000000074B20000-0x00000000750CB000-memory.dmpFilesize
5.7MB