Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
02-05-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
97d72efbb1f6fea3f158b136c330689d.exe
Resource
win7-20240419-en
General
-
Target
97d72efbb1f6fea3f158b136c330689d.exe
-
Size
67KB
-
MD5
97d72efbb1f6fea3f158b136c330689d
-
SHA1
43c884250ed032ced44d72d932518e831a34161d
-
SHA256
2ff91319fbcc02e9dd7d80e21f5f7f48e0ae24b99a1b26625d344ab4812f37c4
-
SHA512
a9937e30d19ebf33ebe4c20792f7499e79996f06b5e3bc6f28d506ba4440640ebc923d424184007f2f111c3706876c029f6d4e41d5ed144c2b8e666b32689596
-
SSDEEP
1536:uuKlhoxbyGiiKkTvTiCUU8b+a1fJ3l4fLU2cjdFZPvf9G95T8KCc4:NKOyGxKIiCV8aa1fJV4zMF54ra
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
0.tcp.eu.ngrok.io:18350
f2d4732908d59805d830a49d36974ac0
-
reg_key
f2d4732908d59805d830a49d36974ac0
-
splitter
Y262SUCZ4UJJ
Signatures
-
Stops running service(s) 3 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 4 0.tcp.eu.ngrok.io 13 0.tcp.eu.ngrok.io 33 0.tcp.eu.ngrok.io 47 0.tcp.eu.ngrok.io 2 pastebin.com 3 pastebin.com -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2648 sc.exe 2640 sc.exe 2872 sc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
powershell.exe97d72efbb1f6fea3f158b136c330689d.exedescription pid process Token: SeDebugPrivilege 2760 powershell.exe Token: SeDebugPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 2204 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 2204 97d72efbb1f6fea3f158b136c330689d.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
97d72efbb1f6fea3f158b136c330689d.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2204 wrote to memory of 2224 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2224 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2224 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2224 wrote to memory of 2760 2224 cmd.exe powershell.exe PID 2224 wrote to memory of 2760 2224 cmd.exe powershell.exe PID 2224 wrote to memory of 2760 2224 cmd.exe powershell.exe PID 2204 wrote to memory of 2976 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2976 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2976 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2976 wrote to memory of 2648 2976 cmd.exe sc.exe PID 2976 wrote to memory of 2648 2976 cmd.exe sc.exe PID 2976 wrote to memory of 2648 2976 cmd.exe sc.exe PID 2204 wrote to memory of 2656 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2656 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2656 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2656 wrote to memory of 2640 2656 cmd.exe sc.exe PID 2656 wrote to memory of 2640 2656 cmd.exe sc.exe PID 2656 wrote to memory of 2640 2656 cmd.exe sc.exe PID 2204 wrote to memory of 2684 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2684 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2204 wrote to memory of 2684 2204 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2684 wrote to memory of 2872 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2872 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2872 2684 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97d72efbb1f6fea3f158b136c330689d.exe"C:\Users\Admin\AppData\Local\Temp\97d72efbb1f6fea3f158b136c330689d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc query windefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc query windefend3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.execmd /c sc stop windefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop windefend3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.execmd /c sc delete windefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete windefend3⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2204-0-0x000007FEF636E000-0x000007FEF636F000-memory.dmpFilesize
4KB
-
memory/2204-1-0x0000000000200000-0x000000000021C000-memory.dmpFilesize
112KB
-
memory/2204-2-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2204-16-0x000007FEF636E000-0x000007FEF636F000-memory.dmpFilesize
4KB
-
memory/2204-15-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-9-0x0000000001F40000-0x0000000001F48000-memory.dmpFilesize
32KB
-
memory/2760-10-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-12-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-11-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-13-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-14-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-7-0x000007FEF60B0000-0x000007FEF6A4D000-memory.dmpFilesize
9.6MB
-
memory/2760-8-0x000000001B7C0000-0x000000001BAA2000-memory.dmpFilesize
2.9MB