Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 04:30
Behavioral task
behavioral1
Sample
8b66ccb77f02e2ff88e9934fe4ab648d.exe
Resource
win7-20231215-en
General
-
Target
8b66ccb77f02e2ff88e9934fe4ab648d.exe
-
Size
402KB
-
MD5
8b66ccb77f02e2ff88e9934fe4ab648d
-
SHA1
3306d54395ab3b21d424fb73308a6ad37b9020bb
-
SHA256
f47e6c4f9dbd723b2dd9db492822967c6257f2f502b57f342908ecaa64dfe4ba
-
SHA512
425e9b883005f0b3e6513d7ea33aea06df9de6c4a64d88a9ba32f56013aa5f93fbc77f965d0e434c461107b71b27506a6e9aa750e207ce4ea70bdb6e37a626ca
-
SSDEEP
6144:1maKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgU:ySmLAuEY71fviagATFmebVQDcYcg
Malware Config
Extracted
njrat
0.6.4
hhhmach.ddns.net:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2704 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe -
Executes dropped EXE 2 IoCs
pid Process 2072 test.exe 2744 Trojan.exe -
Loads dropped DLL 2 IoCs
pid Process 1644 cmd.exe 2072 test.exe -
resource yara_rule behavioral1/memory/2164-19-0x0000000000400000-0x00000000004FB000-memory.dmp upx behavioral1/memory/2164-0-0x0000000000400000-0x00000000004FB000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe 2744 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2744 Trojan.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1644 2164 8b66ccb77f02e2ff88e9934fe4ab648d.exe 16 PID 2164 wrote to memory of 1644 2164 8b66ccb77f02e2ff88e9934fe4ab648d.exe 16 PID 2164 wrote to memory of 1644 2164 8b66ccb77f02e2ff88e9934fe4ab648d.exe 16 PID 2164 wrote to memory of 1644 2164 8b66ccb77f02e2ff88e9934fe4ab648d.exe 16 PID 1644 wrote to memory of 2072 1644 cmd.exe 20 PID 1644 wrote to memory of 2072 1644 cmd.exe 20 PID 1644 wrote to memory of 2072 1644 cmd.exe 20 PID 1644 wrote to memory of 2072 1644 cmd.exe 20 PID 2072 wrote to memory of 2744 2072 test.exe 19 PID 2072 wrote to memory of 2744 2072 test.exe 19 PID 2072 wrote to memory of 2744 2072 test.exe 19 PID 2072 wrote to memory of 2744 2072 test.exe 19 PID 2744 wrote to memory of 2704 2744 Trojan.exe 18 PID 2744 wrote to memory of 2704 2744 Trojan.exe 18 PID 2744 wrote to memory of 2704 2744 Trojan.exe 18 PID 2744 wrote to memory of 2704 2744 Trojan.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b66ccb77f02e2ff88e9934fe4ab648d.exe"C:\Users\Admin\AppData\Local\Temp\8b66ccb77f02e2ff88e9934fe4ab648d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE1⤵
- Modifies Windows Firewall
PID:2704
-
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD542c5854aa0709d8bf6c28ea82c67b9a5
SHA1124ea473f0572009de85a4a46f361109f4fae7d6
SHA25671e1add662041fee9ff0ddf0139154cf006538559af45f34047aac91efb1b8eb
SHA512c0f4412f2237138b5b66ecc285d7f44bacd67ae23feb0a55561cd4f7850ee6b0fd1b1dac3d2725ed4932aaf155b0fbda284a69b07594789bdb4cbcf0f499d95a
-
Filesize
62KB
MD5cb2cc09bf69207261307998c06a4191b
SHA15a0db53afecd9b99e6e232f6cb749e57bb27d175
SHA256cfe978e522a816f7b7801f6d251421aa88279041a7132ce00b858f2a2c6e9bc8
SHA5127b714ed57d00fc4a7bce34cbeeda2f1c410393724a2a25a808035a80ad82cb4c85d9d732b90b74cbf9307648c55e5da38f4c2da9c5bc278539731a07871ffefd