Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
26-04-2024 09:31
General
-
Target
NjRat 0.7D Horror Edition.rar
-
Size
18.9MB
-
MD5
3722a5d14e004bb1e90d0e850366e1ec
-
SHA1
a98916f7add8e783d6646d37680651ca4412220c
-
SHA256
a36807ff99bde01f1d887e6f73d92b1c21a2049726a7d7555845e8f8639c05c1
-
SHA512
7caac7e5a40f88f6757b8beae3c35b1db536008224f9bd15bb67f45521c95c35b3e400a2c828e70a8caaf0d3e90357f5c38ff535b439958bc9eee2d809549724
-
SSDEEP
393216:Bo88DkvZ+wNiWtRReJJB4PWjoNkcZ/aeeV97uVrr0mf26YiPqDKT9:BoVDYiQRRet46UC2fnYEqs9
Malware Config
Extracted
xworm
5.0
html-nl.gl.at.ply.gg:38534
cyG6dP3JpX7QpOYW
-
Install_directory
%Temp%
-
install_file
XWorm V5.2.exe
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
127.0.0.1:6522
b6f83ebf0bce1d5c2e2e278edaabc64b
-
reg_key
b6f83ebf0bce1d5c2e2e278edaabc64b
-
splitter
Y262SUCZ4UJJ
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Kills process with taskkill 1 IoCs
-
Modifies registry class 37 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Horror Edition.rar"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Horror Edition.rar"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\NjRat 0.7D Horror Edition.exe"C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\NjRat 0.7D Horror Edition.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\XClient.exe"C:\Users\Admin\AppData\Roaming\XClient.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\NjRat 0.7D Horror Edition.exe"C:\Users\Admin\AppData\Roaming\NjRat 0.7D Horror Edition.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 13923⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\NjRat 0.7D Horror Edition.exe"C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\NjRat 0.7D Horror Edition.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /alignment=512 /QUIET "C:\Users\Admin\AppData\Local\Temp\stub.il" /output:"C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\Payload.exe"2⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x448 0x2f81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\Payload.exe"C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\Payload.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\Payload.exe"C:\Users\Admin\Desktop\NjRat 0.7D Horror Edition\Payload.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Payload.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
564KB
MD5cf4ed74aefc5cfa43d433c8019d50cef
SHA143b3351e224f760c15af17c7ad92824d6e13577d
SHA256b6a15e953be8ef5bc5c75e335aef0446f7ae2edfd3863420f73b6509c48807ea
SHA512bfcb350644f34f7013705f509e9e78d48cab34d1b8be4d02f15d16aa208cca30227d377892342a00805b21bb5fc153d33ab11c8fa9e49175d098394b7ddf4195
-
Filesize
15.4MB
MD50b8196e6cdd002fa10bfd50843b6b172
SHA12808af92f2136c2dcf06c8bc06dfa3c994dede32
SHA2560b96fadaed63004ab89c43e790100bf0ac03aae66a10239263ae64a9f01819a8
SHA51269c4c2fd64d6886c11eb797a6829e315faffcc0095a884215753632e544727f655838fc34c2a8183179d8db2fdb63183fe0f3b69b9526d5c1fc857ba23b8ea69
-
Filesize
66KB
MD50ee1db9797bf41800cfc7c502a52d1ea
SHA1412c0525c66b6a0ebfad4519d81e9b397747ddb5
SHA256ae6416d4bfcf5d1bb5c9f4ec0851d9e6464369be50c459f12cfbd615ae59aad8
SHA512f7c6ab86bb21b77fdad832e09f037f2e9245b920f2edbc40857567c36bbccd3863d8a5b66f3e3b4286284741ac1e93d25a06d0f264e2e0b2f6c28f9eb0e9b213
-
Filesize
1.1MB
MD5a0a228c187329ad148f33c81ddb430bb
SHA1d70ec83d1b15b3156df73802dd1bec024b1b9346
SHA256b4bfd1ebc50f0eaab3d3f4c2152feae7aa8efad380b85064153a6bfd006c6210
SHA5120fe0a62c07f7ade0e6bfac8843c13c055369177935d801488a993bc4bcdb9da220ba1b37df2027dab8af7c15e5cf00b3e8f223b12165d8a1b0b9c30dc9939332
-
Filesize
15.5MB
MD523f3ea9746e052a4ea7a08b955575730
SHA1be368be9931d2bc6f21da8c0064435f9aaca08d9
SHA2569822384adf44368d8f2a42db17f76ab19c9e5ebdbe35bf65e22b3fcf7362f774
SHA512c80fc29163cd17512b9e14979eec50ea14223c0aa5081ba5f6b69e825d683c32d1e1c995d9b8c38bf5a96e441393aee47592af7856c251ae25c85d9ddae35861
-
Filesize
53KB
MD556c8de31759951eb1a92846095d6de82
SHA1ec2005e7a2af524b920756f080675b054e4b603f
SHA256bcd362c3755b9ed31193b0d1b5794e191a08650ea9dadb9c9eebe17ec2d9e71a
SHA51280747831c294dbf23b85bd827452720ade8fa9b0e5767c53ea3bef0fe358c09d13f0d0d08a86aaf12590e6d68017273b6c7661e9b08e9bb270e16abb629be00f
-
Filesize
564KB
MD5b5cd586057a0907047b726f0cf69a407
SHA1412241bbb62fea6003741e4f65467babe419cb1f
SHA2569d6e1d086d4dadeacce4e00174ff7bc42509dde100326c13522d934a41bac97b
SHA512db6fe4a27aa2a3647d768a65a9347ff164d2bb7147b01527b13173a6f442e92ea8a2619599f250278fab03cb081fd24a0dce998d61924dbc175242cb16408e8d
-
Filesize
487B
MD54d18ac38a92d15a64e2b80447b025b7e
SHA15c34374c2dd5afa92e0489f1d6f86dde616aca6c
SHA256835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
SHA51272be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
-
Filesize
43KB
MD5d4b80052c7b4093e10ce1f40ce74f707
SHA12494a38f1c0d3a0aa9b31cf0650337cacc655697
SHA25659e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
SHA5123813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
-
Filesize
99KB
MD58ce3060686462fc72ece2701caa13e3b
SHA119fc9892200de4db332ddd0c14b4b6fd9a35ccd4
SHA256881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
SHA512ef38e00b054240a0d4747bfd79db860015ed027735c360de58af6889a69482109ccf74770608a2750542457ac38aa79367431ff6ca77fae44d7e3a7023f33a17
-
Filesize
44KB
MD511fde8a47647c3bc98d57f3a9f3a97a3
SHA1e813c17973e77b7aa22b9f539c3c97c624acafb1
SHA2567032cb496f866ec1c9304f2c3cd8859472168838a11aba1571f51875a75074af
SHA5121401f40569db7679014ab282477a5560b3bc6f51284e501e0e878881522db102b448566bae50ab6c1027a196de410a9ac8770dfa2208d14e5dfcc3c05e766763
-
Filesize
8KB
MD5ddce53e6a021aa8e146d9fce35e97e53
SHA17a4c69888e821e1d775c899ec5b3fdab267c7fbd
SHA25657b66a81716e1737e5b8ecff2c269f00e2ca6ffbff88960e973c02f5800037cc
SHA512a644892e51a5f09b35b3a89fee6031eeb92eb3ed5e5d05b8e06a96f0348305366f211ee959f94aaedb6f0c59608e49a1c2efb157f09cf520c43fe5455abfee15
-
Filesize
77KB
MD59b376f0d44995ca15d43f7943a602fb2
SHA118a2bb7d13836256bd5f39089203f18d740669d5
SHA25627528a77e27d02aadecabfdf658b2da638bb0ca2f2c60bdd9d0fd5338c1fc346
SHA5124dfb0c49816e0d0c2f7d0d76081725bd48d3713506ec51ac6c06ae7092908d14e3683d707d6f332505163fb0ade0ee6b50a355cd69c25725e829ebb23a3e93b2
-
Filesize
65KB
MD5c179e212316f26ce9325a8d80d936666
SHA114d08b3cda60341d1e9187fc14bd64ebefe4a5b6
SHA25613043521ed6876edf2736fc46a7c49e6b639cfa7a866ca11de26f119796cd521
SHA5121b5eb687a9932c82ab2e655dbc5df8ba667a023e7568dbbd13c503a54661763193bde11937f87e2e09b88d770c8357eda07589d526e6103db058038e3ce3b750
-
Filesize
284KB
MD5ac43720c43dcf90b2d57d746464ad574
SHA1eae39df1c717ca74f6f04d5ca8478ea55145535a
SHA256ca6367d1ab873a55ced13d7024c530bbe4a6a703813225233e59041c7ce14eaa
SHA5129082b3cd8b36031256923c8f2bed628e9331129bbf09d111d9d02268a49e493248e5638ddee5b02da66e9159a608f8f26499ca0f736d6a369a30f71950c60d40
-
Filesize
46KB
MD52d65bc3bff4a5d31b59f5bdf6e6311d7
SHA143962fbeb93fc267fb1c7036a12b8c5d6f40c28a
SHA256010b1ec566be774a2d12146f9826aa31fd7eb6ffe7b45ce5e572b2d8c7f815c3
SHA512b210d447cc9b4b89402a2a1d3d5e9cfe13ae897c47094be4110ed3aac109152c8a45ec138f73b703e7d3799934234cba4ca3f2439b3dd193a4cec671b9edaa6a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
64KB
-
Filesize
15.5MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB