Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 14:17
Static task
static1
Behavioral task
behavioral1
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Resource
win10v2004-20240221-en
General
-
Target
a3ff56835b4bd0e80f6e95fbfc741a8e.exe
-
Size
104KB
-
MD5
a3ff56835b4bd0e80f6e95fbfc741a8e
-
SHA1
8af2b8e66107890df87a3c6ee9a5712228f95d8a
-
SHA256
ee9fd41093ef9d4e21a78ab987df6ad42a6fa5dcea7ebd9c5ff1e1f388720d8e
-
SHA512
1dbc80bccb87b4f1330a783fb4c2c7840cec6d9c280c261c8df2d8bdd4188ca1e779665f00cb35440660f70e95a06f178387aa113803ef0581dd2d658694107b
-
SSDEEP
1536:+eS3Yzxx6ZTD9Um9UoCONGAho+nuzGHRbVV3jEbgkxpPNOf5uze3S:+eS3Yzxx6R63ahJn9RStUYzeC
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
system
4.tcp.ngrok.io:14964
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ZbECSrTmBt = "C:\\Users\\Admin\\AppData\\Roaming\\LzYAJeGoJn\\jHHCSpKiYF.exe" a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
Processes:
flow ioc 57 4.tcp.ngrok.io 69 4.tcp.ngrok.io 28 4.tcp.ngrok.io 32 4.tcp.ngrok.io -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 348 set thread context of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exepid process 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process Token: SeDebugPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: 33 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe Token: SeIncBasePriorityPrivilege 5084 a3ff56835b4bd0e80f6e95fbfc741a8e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a3ff56835b4bd0e80f6e95fbfc741a8e.exedescription pid process target process PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe PID 348 wrote to memory of 5084 348 a3ff56835b4bd0e80f6e95fbfc741a8e.exe a3ff56835b4bd0e80f6e95fbfc741a8e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"C:\Users\Admin\AppData\Local\Temp\a3ff56835b4bd0e80f6e95fbfc741a8e.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a3ff56835b4bd0e80f6e95fbfc741a8e.exe.logFilesize
507B
MD58cf94b5356be60247d331660005941ec
SHA1fdedb361f40f22cb6a086c808fc0056d4e421131
SHA25652a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0
SHA512b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651
-
memory/348-3-0x0000000005420000-0x00000000059C4000-memory.dmpFilesize
5.6MB
-
memory/348-11-0x0000000074B00000-0x00000000752B0000-memory.dmpFilesize
7.7MB
-
memory/348-0-0x0000000000410000-0x0000000000430000-memory.dmpFilesize
128KB
-
memory/348-4-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/348-5-0x0000000004F10000-0x0000000004FAC000-memory.dmpFilesize
624KB
-
memory/348-7-0x0000000004DE0000-0x0000000004DEA000-memory.dmpFilesize
40KB
-
memory/348-1-0x0000000074B00000-0x00000000752B0000-memory.dmpFilesize
7.7MB
-
memory/348-2-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB
-
memory/5084-8-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5084-12-0x0000000074B00000-0x00000000752B0000-memory.dmpFilesize
7.7MB
-
memory/5084-13-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/5084-14-0x0000000005510000-0x000000000551A000-memory.dmpFilesize
40KB
-
memory/5084-15-0x0000000074B00000-0x00000000752B0000-memory.dmpFilesize
7.7MB
-
memory/5084-16-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB