Analysis
-
max time kernel
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
06-01-2024 05:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4574bd93391feb09a4f2fb7feaa0f29d.exe
Resource
win7-20231215-en
4 signatures
150 seconds
General
-
Target
4574bd93391feb09a4f2fb7feaa0f29d.exe
-
Size
33KB
-
MD5
4574bd93391feb09a4f2fb7feaa0f29d
-
SHA1
8bf4ce7c275d6efb9470f617189d2945f9039935
-
SHA256
cdc771adbd55add756c3fd400ae846c8b8d378c68feac22e0bcc96dc480a6dc4
-
SHA512
f346a22c4b6b9dc3199300b591b40cfc54555b849e90fa38d3001c4a7f4d6ca3b139348b60409903ec3bd7fd9742a3e2ddba510485e4d68d7f5be43a029fadfa
-
SSDEEP
768:VvTgsrbTI3IOTT95Hrg1XVbXBAQ/nvF8Nul2y:tJbaM7BHnmulZ
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
HacKed
C2
rxlwee.ddns.net:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
4574bd93391feb09a4f2fb7feaa0f29d.exedescription pid process target process PID 1020 wrote to memory of 4668 1020 4574bd93391feb09a4f2fb7feaa0f29d.exe netsh.exe PID 1020 wrote to memory of 4668 1020 4574bd93391feb09a4f2fb7feaa0f29d.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4574bd93391feb09a4f2fb7feaa0f29d.exe"C:\Users\Admin\AppData\Local\Temp\4574bd93391feb09a4f2fb7feaa0f29d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\4574bd93391feb09a4f2fb7feaa0f29d.exe" "4574bd93391feb09a4f2fb7feaa0f29d.exe" ENABLE2⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1020-1-0x000000001B850000-0x000000001BD1E000-memory.dmpFilesize
4.8MB
-
memory/1020-0-0x00007FFDF8350000-0x00007FFDF8CF1000-memory.dmpFilesize
9.6MB
-
memory/1020-2-0x0000000000D20000-0x0000000000D30000-memory.dmpFilesize
64KB
-
memory/1020-4-0x00007FFDF8350000-0x00007FFDF8CF1000-memory.dmpFilesize
9.6MB
-
memory/1020-5-0x000000001B2A0000-0x000000001B346000-memory.dmpFilesize
664KB
-
memory/1020-3-0x0000000000C50000-0x0000000000C66000-memory.dmpFilesize
88KB
-
memory/1020-6-0x000000001BEB0000-0x000000001BF4C000-memory.dmpFilesize
624KB
-
memory/1020-7-0x0000000000C60000-0x0000000000C68000-memory.dmpFilesize
32KB
-
memory/1020-8-0x00007FFDF8350000-0x00007FFDF8CF1000-memory.dmpFilesize
9.6MB