Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-02-2024 22:10

General

  • Target

    a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7.exe

  • Size

    81KB

  • MD5

    120fc4b8089f3e0b8c37cc6fe99527a4

  • SHA1

    0223c0f378a2121522739c96264e76245d8c34f2

  • SHA256

    a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7

  • SHA512

    a3450d5ff51ff1f2ad9e735d9478c6efc21c5ccd1eb68434287fc81465dc9ed4457a79766e0f34384453fc74544dd394be07a4c542df2be8876b09713407f32a

  • SSDEEP

    1536:bWPv13GIJ+cbqWvhzCeJtjxPwFV1FJi1oDb/twZyBiGVvdLuwoSjBH:bWP6ceWvhzJP2woftwQiGhdywoI

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

russia5319.ddns.net:1177

Mutex

d2c0291b8e251a997c188028968b747b

Attributes
  • reg_key

    d2c0291b8e251a997c188028968b747b

  • splitter

    |'|'|

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • ModiLoader Second Stage 2 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Drops startup file 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7.exe
    "C:\Users\Admin\AppData\Local\Temp\a87e5df2fd734bb8bf0ee6395289065506e7064b266b90714e9c35b4d2f6c4c7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\shodanEngine.exe
      "C:\Users\Admin\AppData\Local\Temp\shodanEngine.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:1160
    • C:\Users\Admin\AppData\Local\Temp\clener.exe
      "C:\Users\Admin\AppData\Local\Temp\clener.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Roaming\clener.exe
        "C:\Users\Admin\AppData\Roaming\clener.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\clener.exe" "clener.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          PID:1916
    • C:\Users\Admin\AppData\Local\Temp\dlhost.exe
      "C:\Users\Admin\AppData\Local\Temp\dlhost.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dlhost.exe" "dlhost.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:1088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab29E0.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar2A60.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\clener.exe

    Filesize

    32KB

    MD5

    9d0c7f378c611384c5588c3cb330a57e

    SHA1

    2773d0025791feb56d9bafba1ac6de934508cc40

    SHA256

    eaa231c6c77b4ae0051431ebe5f10561742701544937921da3568d41e7b577af

    SHA512

    ebaad0cc84ea696a6d272e3b5072367d61f9cd19d61b6e33757dd5c73adfdb64e3d674c4b054f8560930a6dffdb508680124d0f2e27ae5e499c2e506488f1509

  • \Users\Admin\AppData\Local\Temp\dlhost.exe

    Filesize

    23KB

    MD5

    a8454775f251fc38e87e252cc9854355

    SHA1

    79c3ba51d940977b881a185f804d63bdfce57f6d

    SHA256

    5358f382c0588fd21df9a94a8f3b287cf5c0d300af764dd55056be48c51b1528

    SHA512

    7ef001bc9299c7d8972fbd2a8643f7eb111ef425c72aea3cd3212d58a8c826e0640c7e4edff44516a64708a0493e21182ae663a95bcd761fe6c4262d43527ac7

  • \Users\Admin\AppData\Local\Temp\shodanEngine.exe

    Filesize

    15KB

    MD5

    2f413a8c1dfdf364c04807bc5fb131f8

    SHA1

    72afc1b6c1b20fd787cbfd50cfdeaad1bc4d4f81

    SHA256

    b6e3a1cda525c4a129ab90e97217f324b13c343d92224628b7c365e726c87745

    SHA512

    f6c921aec38c32b5c21eb229aaf793610408b0027653d1085a96d9f0f0f576ca54734b6124c411061a64776b8825ebd17304ee49a4d78d3aea985ddc46697edf

  • memory/1160-28-0x00000000049E0000-0x0000000004A20000-memory.dmp

    Filesize

    256KB

  • memory/1160-498-0x00000000049E0000-0x0000000004A20000-memory.dmp

    Filesize

    256KB

  • memory/1160-495-0x0000000074A00000-0x00000000750EE000-memory.dmp

    Filesize

    6.9MB

  • memory/1160-27-0x00000000049E0000-0x0000000004A20000-memory.dmp

    Filesize

    256KB

  • memory/1160-23-0x0000000074A00000-0x00000000750EE000-memory.dmp

    Filesize

    6.9MB

  • memory/1160-29-0x00000000049E0000-0x0000000004A20000-memory.dmp

    Filesize

    256KB

  • memory/1160-22-0x0000000001340000-0x000000000134A000-memory.dmp

    Filesize

    40KB

  • memory/2104-20-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2320-496-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/2320-24-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/2320-497-0x0000000000C30000-0x0000000000C70000-memory.dmp

    Filesize

    256KB

  • memory/2320-25-0x0000000000C30000-0x0000000000C70000-memory.dmp

    Filesize

    256KB

  • memory/2752-276-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/2752-277-0x00000000008E0000-0x0000000000920000-memory.dmp

    Filesize

    256KB

  • memory/2752-499-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-275-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-26-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB