Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe
Resource
win10v2004-20240226-en
General
-
Target
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe
-
Size
184KB
-
MD5
021b477ace5e87113272fd8b16830051
-
SHA1
d55ddb61b67e53245adc5bd12822ea56f1602820
-
SHA256
e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd
-
SHA512
ef8c8ff1ff3326848becef2615bd2a629dd1eced13c9b9776d75f3a5cfd2e913324422f806264126befdd0d6908d16be081218ab61fe20ef95111cf9a41c8817
-
SSDEEP
3072:qUZiBJUB7JXbbkiTIR4JQffGaJNnN7SD+631zmh6Ty1:hiBWBdbkiTIR4ufGaJNnN7SC631zmh6+
Malware Config
Extracted
njrat
0.7d
HacKed
18.ip.gl.ply.gg:43389
4ac5522ba6619835b9ac056e603570c4
-
reg_key
4ac5522ba6619835b9ac056e603570c4
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3668 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe -
Executes dropped EXE 2 IoCs
pid Process 2352 server.exe 1988 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4ac5522ba6619835b9ac056e603570c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4ac5522ba6619835b9ac056e603570c4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1092 set thread context of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 2352 set thread context of 1988 2352 server.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe Token: SeDebugPrivilege 2352 server.exe Token: SeDebugPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe Token: 33 1988 server.exe Token: SeIncBasePriorityPrivilege 1988 server.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 1092 wrote to memory of 2164 1092 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 89 PID 2164 wrote to memory of 2352 2164 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 93 PID 2164 wrote to memory of 2352 2164 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 93 PID 2164 wrote to memory of 2352 2164 e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe 93 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 2352 wrote to memory of 1988 2352 server.exe 94 PID 1988 wrote to memory of 3668 1988 server.exe 95 PID 1988 wrote to memory of 3668 1988 server.exe 95 PID 1988 wrote to memory of 3668 1988 server.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe"C:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exeC:\Users\Admin\AppData\Local\Temp\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp\server.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵
- Modifies Windows Firewall
PID:3668
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd.exe.log
Filesize224B
MD59c4b66f77f12558c48b620ddfb44029d
SHA1446651db643b943ec37b9b3599655e211a4bc73e
SHA25642f723d18283fda6a0904046cc29ee8d10e562d20c7615259a46ae9c0e4c9708
SHA512983aed0ec15a79b716ac6dc080146e4ed098c117c31167053fb5971649dc621d1db5292fdd76f3010f094b75d57ea0bdb35bc829c6ba37e4d276b266361dee8e
-
Filesize
184KB
MD5021b477ace5e87113272fd8b16830051
SHA1d55ddb61b67e53245adc5bd12822ea56f1602820
SHA256e31f4f05884e97c569d6641257f40c4634004565874178c122817538e89948bd
SHA512ef8c8ff1ff3326848becef2615bd2a629dd1eced13c9b9776d75f3a5cfd2e913324422f806264126befdd0d6908d16be081218ab61fe20ef95111cf9a41c8817
-
Filesize
81KB
MD5db9c6b9fcf413dce849ba52039c130e3
SHA1bc4bfb4e140963fcdbdcf7cf0cd38e13f3ecdf36
SHA2567d9278f9a6f5f1830241f813c51a7f0ca2958b4caef2da4858ef4ba810bd150f
SHA5121fc26cc190662f64a92742d587f2728f72aab8b7718929214e58b081d4d6d9d4961014441cd4e8f5e491dd34b844559f59550ac4d382a53ca89b40b283e9b2fd
-
Filesize
126KB
MD5d08bef3f48fc0574a61f2bc7a4525013
SHA1f69c247683e534c4e25ed1424849e7f273a3a380
SHA256d84be1e1750dc489209e3c5dd1681c7e0a208a1b6657ae1d363979da22e44dac
SHA512eea8445b2ea99083962cb98ab65df2db2a89a80c63ae017c5ea52440500ba0683a0a4a9c54d830b427e48900462ef15f2bac633f89bb377c3f25e53f91f02f58