Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    24-02-2024 02:16

General

  • Target

    05e8c507d40aa6d05720a1f6bdf7f52e.exe

  • Size

    3.4MB

  • MD5

    05e8c507d40aa6d05720a1f6bdf7f52e

  • SHA1

    0d065c8aa7f5399a32eea3185b865770bfc26fd8

  • SHA256

    ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405

  • SHA512

    9178b7678d4432a3fa813ee9cc5cdb0c60bdba8b69a4c6ab15932973a964f8d6066e82c432f8799830f8121df4ddea12c6cd2061db197f5763355de6479b89c2

  • SSDEEP

    49152:HJTIYbGQdAjED+aE0LaiIve+mbrErGEVV1BCjBysTt0jUiwg:HJThbGQdAjED+aE0LaitrErrT14

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

pcpanel.hackcrack.io:32544

Mutex

Windows Explorer

Attributes
  • reg_key

    Windows Explorer

  • splitter

    |'|'|

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Detect ZGRat V1 5 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • AgentTesla payload 6 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05e8c507d40aa6d05720a1f6bdf7f52e.exe
    "C:\Users\Admin\AppData\Local\Temp\05e8c507d40aa6d05720a1f6bdf7f52e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:672
            • C:\Windows\system32\netsh.exe
              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE
              6⤵
              • Modifies Windows Firewall
              PID:2128
    • C:\Users\Admin\AppData\Local\Temp\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:2544
    • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe
      "C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe"
      2⤵
      • Executes dropped EXE
      • Enumerates system info in registry
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

    Filesize

    2.9MB

    MD5

    da3725bb70ed56821687eaf2cba15c78

    SHA1

    f557e7e8693d969735d32f99c8f42d5ba01d1fae

    SHA256

    e3e6d51994bc22985115fbe9a4a3e05da5a28cd3e516847d64eba894158b37d9

    SHA512

    588b3d9037bf45c63d70d8f1ca60fe37f580f794fa440201ce6af2c2ebfc7bfe87de9d0439a93499db01254d643214a0a3b18442b06c573588a12b27fb0a8613

  • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

    Filesize

    2.9MB

    MD5

    6e916f0cd1ac95cc15fabd7bb03f63e4

    SHA1

    db7798128559847181b9d1f5c12630ddd98b7cb4

    SHA256

    4c7bf38fa20dde78f0ef32674d6f8c3e4f2f34404e569f5dcf8be148797d77b3

    SHA512

    fb5b3a2f81261ae8baa559d0394bad394d61dc5587d5b1a80adcde576f8ff9f0ce110d6c3c92dd02a8fb71ff18c63962451755c6b90039afb827df4732e05800

  • C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

    Filesize

    2.9MB

    MD5

    1fcf21d204fe08aa3e82cd5c7f6935b9

    SHA1

    6c40be116f8b7a63d5d6365b4e13b1e523bd3002

    SHA256

    8dc48ac87178f7ad37d1cd9a79a3ce686ac8ca6e7b3ad3ee75bdc306c0a6c6aa

    SHA512

    3eed29657fc7074a8bb76f2dedabef77fe9dd0438fe9bda15854a525726d38f64490229017222540eb59d15616987a672537b7510f693c65617bfd23afe1d7df

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe

    Filesize

    461KB

    MD5

    ee76425b767c9ab812a53c133b8363f8

    SHA1

    1daa4700a5f1849eb7e810986ac24bd58786da61

    SHA256

    f962e1a60673963b7c2fa51a0663260df63771dfbd7423af67c2d142f7245747

    SHA512

    004d1b4acc7084ba8c520d94032c19342228ed6346321b04641450f87a32f78a92212e3940e4cf0790af2e5640c6001e7c805dc99cf8f9a146d752b5ee117c3b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

    Filesize

    162KB

    MD5

    a9b0d84f4872b4352371e33a973cfdda

    SHA1

    6a2f976500c939987ed0427a5c7c88103e79471a

    SHA256

    937c2943f9773d84a1ad3540115abe9447c74085a08f1c5f5ec19c5d6145b1bb

    SHA512

    f56ef1f698c8bfd8e047f19b1e5da6dc1fb8f07e441bc2efebda2beb6f63725e385ee28946baa0841cad007288fd8524c799504708bce880e2358bdac2505662

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

    Filesize

    325KB

    MD5

    f36e535fdc82208fca08acfa44f790c6

    SHA1

    a3cc1aa7d614094faebada2aed1e6c519bd18c94

    SHA256

    51efbe235b492c7e99c480915c7eeecf85f5ee6d540189ee5aa54fe9f0fafcdc

    SHA512

    631db5246159e045ed6911867f25991ae8824951e608c2fef25bc48482271aeb3ad26f1c98a04b4cbbf431ce20ef027cacb4bf0b3d85e048885da2b709f3a9af

  • memory/672-79-0x000007FEEF670000-0x000007FEF000D000-memory.dmp

    Filesize

    9.6MB

  • memory/672-80-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/672-81-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/672-78-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/672-77-0x000007FEEF670000-0x000007FEF000D000-memory.dmp

    Filesize

    9.6MB

  • memory/672-74-0x000007FEEF670000-0x000007FEF000D000-memory.dmp

    Filesize

    9.6MB

  • memory/672-76-0x0000000001F30000-0x0000000001FB0000-memory.dmp

    Filesize

    512KB

  • memory/764-23-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/764-0-0x0000000000360000-0x00000000006D6000-memory.dmp

    Filesize

    3.5MB

  • memory/764-1-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2036-65-0x000007FEEF670000-0x000007FEF000D000-memory.dmp

    Filesize

    9.6MB

  • memory/2036-75-0x000007FEEF670000-0x000007FEF000D000-memory.dmp

    Filesize

    9.6MB

  • memory/2036-68-0x000007FEEF670000-0x000007FEF000D000-memory.dmp

    Filesize

    9.6MB

  • memory/2036-66-0x00000000009F0000-0x0000000000A70000-memory.dmp

    Filesize

    512KB

  • memory/2036-67-0x0000000000360000-0x000000000036C000-memory.dmp

    Filesize

    48KB

  • memory/2380-32-0x000000001B060000-0x000000001B0E0000-memory.dmp

    Filesize

    512KB

  • memory/2380-18-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2380-41-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2380-13-0x0000000000DC0000-0x0000000000E38000-memory.dmp

    Filesize

    480KB

  • memory/2544-19-0x0000000000150000-0x000000000017A000-memory.dmp

    Filesize

    168KB

  • memory/2544-20-0x000000001A850000-0x000000001A8D0000-memory.dmp

    Filesize

    512KB

  • memory/2544-24-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2556-48-0x0000000004D00000-0x0000000004D40000-memory.dmp

    Filesize

    256KB

  • memory/2556-43-0x0000000005020000-0x0000000005216000-memory.dmp

    Filesize

    2.0MB

  • memory/2556-53-0x0000000004D00000-0x0000000004D40000-memory.dmp

    Filesize

    256KB

  • memory/2556-42-0x0000000004D00000-0x0000000004D40000-memory.dmp

    Filesize

    256KB

  • memory/2556-21-0x0000000001260000-0x0000000001556000-memory.dmp

    Filesize

    3.0MB

  • memory/2556-45-0x0000000004D00000-0x0000000004D40000-memory.dmp

    Filesize

    256KB

  • memory/2556-50-0x0000000074BB0000-0x000000007529E000-memory.dmp

    Filesize

    6.9MB

  • memory/2556-44-0x0000000000B00000-0x0000000000B1A000-memory.dmp

    Filesize

    104KB

  • memory/2556-49-0x0000000009010000-0x00000000090C0000-memory.dmp

    Filesize

    704KB

  • memory/2556-31-0x0000000074BB0000-0x000000007529E000-memory.dmp

    Filesize

    6.9MB

  • memory/2588-37-0x0000000000D40000-0x0000000000D96000-memory.dmp

    Filesize

    344KB

  • memory/2588-51-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2588-64-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2588-52-0x0000000002260000-0x00000000022E0000-memory.dmp

    Filesize

    512KB

  • memory/2588-38-0x0000000000240000-0x0000000000248000-memory.dmp

    Filesize

    32KB

  • memory/2588-39-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

    Filesize

    9.9MB

  • memory/2588-40-0x0000000002260000-0x00000000022E0000-memory.dmp

    Filesize

    512KB