Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe
Resource
win10v2004-20240226-en
General
-
Target
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe
-
Size
184KB
-
MD5
021b477ace5e87113272fd8b16830051
-
SHA1
d55ddb61b67e53245adc5bd12822ea56f1602820
-
SHA256
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd
-
SHA512
ef8c8ff1ff3326848becef2615bd2a629dd1eced13c9b9776d75f3a5cfd2e913324422f806264126befdd0d6908d16be081218ab61fe20ef95111cf9a41c8817
-
SSDEEP
3072:qUZiBJUB7JXbbkiTIR4JQffGaJNnN7SD+631zmh6Ty1:hiBWBdbkiTIR4ufGaJNnN7SC631zmh6+
Malware Config
Extracted
njrat
0.7d
HacKed
18.ip.gl.ply.gg:43389
4ac5522ba6619835b9ac056e603570c4
-
reg_key
4ac5522ba6619835b9ac056e603570c4
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2468 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 2700 server.exe 2532 server.exe -
Loads dropped DLL 3 IoCs
pid Process 2752 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 2752 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 2700 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\4ac5522ba6619835b9ac056e603570c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\4ac5522ba6619835b9ac056e603570c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2500 set thread context of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2700 set thread context of 2532 2700 server.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe Token: SeDebugPrivilege 2700 server.exe Token: SeDebugPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe Token: 33 2532 server.exe Token: SeIncBasePriorityPrivilege 2532 server.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2500 wrote to memory of 2752 2500 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 28 PID 2752 wrote to memory of 2700 2752 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 29 PID 2752 wrote to memory of 2700 2752 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 29 PID 2752 wrote to memory of 2700 2752 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 29 PID 2752 wrote to memory of 2700 2752 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 29 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2700 wrote to memory of 2532 2700 server.exe 30 PID 2532 wrote to memory of 2468 2532 server.exe 31 PID 2532 wrote to memory of 2468 2532 server.exe 31 PID 2532 wrote to memory of 2468 2532 server.exe 31 PID 2532 wrote to memory of 2468 2532 server.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe"C:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exeC:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp\server.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
PID:2468
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5021b477ace5e87113272fd8b16830051
SHA1d55ddb61b67e53245adc5bd12822ea56f1602820
SHA256e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd
SHA512ef8c8ff1ff3326848becef2615bd2a629dd1eced13c9b9776d75f3a5cfd2e913324422f806264126befdd0d6908d16be081218ab61fe20ef95111cf9a41c8817