Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 22:03
Static task
static1
Behavioral task
behavioral1
Sample
a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe
Resource
win10v2004-20240226-en
General
-
Target
a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe
-
Size
432KB
-
MD5
ad0f6231d44f6d0e08379256a3f765c0
-
SHA1
765c2ba3990b9c2a603a0012dfac8e34e39eda38
-
SHA256
a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016
-
SHA512
8bcf9c48c9137b897194cd757ff80153462ce2ad2f2d468ab70ba4479808f3a8bd99006d50a0802289de43092b7079286a86091674d0173325b50ad089309eb0
-
SSDEEP
96:fsDYb94x6pIEYaXcwhx5zWLYxT9FS7Z0epAIb+zNt:UEb94x8pYapz1WLOxU7Z0dcY
Malware Config
Extracted
njrat
0.7d
2021
aqq.linkpc.net:999
a1776750d898d3976ceabc94432acfb1
-
reg_key
a1776750d898d3976ceabc94432acfb1
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1800 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe -
Executes dropped EXE 1 IoCs
Processes:
System64.exepid process 3756 System64.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
System64.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a1776750d898d3976ceabc94432acfb1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System64.exe\" .." System64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a1776750d898d3976ceabc94432acfb1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System64.exe\" .." System64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
System64.exedescription pid process Token: SeDebugPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe Token: 33 3756 System64.exe Token: SeIncBasePriorityPrivilege 3756 System64.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exeSystem64.exedescription pid process target process PID 3224 wrote to memory of 3756 3224 a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe System64.exe PID 3224 wrote to memory of 3756 3224 a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe System64.exe PID 3756 wrote to memory of 1800 3756 System64.exe netsh.exe PID 3756 wrote to memory of 1800 3756 System64.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe"C:\Users\Admin\AppData\Local\Temp\a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System64.exe"C:\Users\Admin\AppData\Roaming\System64.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\System64.exe" "System64.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\System64.exeFilesize
432KB
MD5ad0f6231d44f6d0e08379256a3f765c0
SHA1765c2ba3990b9c2a603a0012dfac8e34e39eda38
SHA256a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016
SHA5128bcf9c48c9137b897194cd757ff80153462ce2ad2f2d468ab70ba4479808f3a8bd99006d50a0802289de43092b7079286a86091674d0173325b50ad089309eb0
-
memory/3224-0-0x0000000000D20000-0x0000000000D92000-memory.dmpFilesize
456KB
-
memory/3224-1-0x0000000001540000-0x000000000154C000-memory.dmpFilesize
48KB
-
memory/3224-2-0x00007FFC5D430000-0x00007FFC5DEF1000-memory.dmpFilesize
10.8MB
-
memory/3224-15-0x00007FFC5D430000-0x00007FFC5DEF1000-memory.dmpFilesize
10.8MB
-
memory/3756-16-0x00007FFC5D430000-0x00007FFC5DEF1000-memory.dmpFilesize
10.8MB
-
memory/3756-17-0x000000001BC40000-0x000000001BC50000-memory.dmpFilesize
64KB
-
memory/3756-18-0x00007FFC5D430000-0x00007FFC5DEF1000-memory.dmpFilesize
10.8MB
-
memory/3756-19-0x000000001BC40000-0x000000001BC50000-memory.dmpFilesize
64KB