Resubmissions
01/02/2024, 21:42
240201-1ktd1shaeq301/02/2024, 21:36
240201-1f9kfaefd3401/02/2024, 21:35
240201-1fhrqaefb41031/01/2024, 01:20
240131-bqaresggh810Analysis
- max time kernel
1800s - max time network
1169s - platform
windows11-21h2_x64 - resource
win11-20231215-en - resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system - submitted
01/02/2024, 21:35
Static task
static1
1 signatures
General
- Target 8312919bf75cb86a87b66dc28fcc8f99.exe
- Size 328KB
- Sample240201-1fhrqaefb4
- SHA256 c2e815a0f25073bb59ad24acd358e72b557a01443fe8a6d79e2acf599bcb592a
- MD5 8312919bf75cb86a87b66dc28fcc8f99
- SHA1 60941b4bef8527922ed282953d1224701b6ec7c2
- SHA512 7e3999007e96ff9b92ca56bb82485d90b048270af3221896bc707bb5b86d85c5fb05f3ba95fec13d2e5c4389de143e9e880a934ba6298321a1e0369783ce6741
- SSDEEP 6144:VdRVzSkGTxSLD8uq5CaOPs47bhqUdIT+trBfkSGL:VhqxSLo5C1Ps4XhWT+trB8S
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
first
C2
-
127.0.0.1:80
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Inject32.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Inject32.exe - Executes dropped EXE 2 IoCs
pid Process 4456 Server.exe 4316 Inject32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4456 Server.exe 4316 Inject32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe Token: SeIncBasePriorityPrivilege 4316 Inject32.exe Token: 33 4316 Inject32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5816 wrote to memory of 4456 5816 8312919bf75cb86a87b66dc28fcc8f99.exe 80 PID 5816 wrote to memory of 4456 5816 8312919bf75cb86a87b66dc28fcc8f99.exe 80 PID 5816 wrote to memory of 4456 5816 8312919bf75cb86a87b66dc28fcc8f99.exe 80 PID 4456 wrote to memory of 4316 4456 Server.exe 83 PID 4456 wrote to memory of 4316 4456 Server.exe 83 PID 4456 wrote to memory of 4316 4456 Server.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\8312919bf75cb86a87b66dc28fcc8f99.exe"C:\Users\Admin\AppData\Local\Temp\8312919bf75cb86a87b66dc28fcc8f99.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\Inject32.exe"C:\Users\Admin\AppData\Local\Temp\Inject32.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Server.exe
- Size 43KB
- SHA256 252795b24c0dabe9d0fca60833faca602cc60e0757f0eae8536a2a5c70a9a43c
- MD5 92fdab908d9711e7a36872207f0a6a67
- SHA1 b356e253edaf807059b1ea4a15d8b26e4a8e4c0e
- SHA512 4e3697aabb41c107118d0dc1d29a0b0a169f803d160fbb187f0ea3318eac58fe5623e3a4356fc238dc03483087498c2972e872c0a85bd5545f030ea2edb0b120
- SSDEEP 384:OZyqlHvw99nNklijEyLon0XvVOoMKvTUX7hDO9D9O5UE5QzwBlpJNakkjh/TzF7z:0u6AjRLs0XNOOvIX5vQO+bX+L
- MD5 SHA1 SHA512 SSDEEP