Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02-05-2024 04:01
Static task
static1
Behavioral task
behavioral1
Sample
97d72efbb1f6fea3f158b136c330689d.exe
Resource
win7-20240419-en
General
-
Target
97d72efbb1f6fea3f158b136c330689d.exe
-
Size
67KB
-
MD5
97d72efbb1f6fea3f158b136c330689d
-
SHA1
43c884250ed032ced44d72d932518e831a34161d
-
SHA256
2ff91319fbcc02e9dd7d80e21f5f7f48e0ae24b99a1b26625d344ab4812f37c4
-
SHA512
a9937e30d19ebf33ebe4c20792f7499e79996f06b5e3bc6f28d506ba4440640ebc923d424184007f2f111c3706876c029f6d4e41d5ed144c2b8e666b32689596
-
SSDEEP
1536:uuKlhoxbyGiiKkTvTiCUU8b+a1fJ3l4fLU2cjdFZPvf9G95T8KCc4:NKOyGxKIiCV8aa1fJV4zMF54ra
Malware Config
Extracted
njrat
<- NjRAT 0.7d Horror Edition ->
Victim
0.tcp.eu.ngrok.io:18350
f2d4732908d59805d830a49d36974ac0
-
reg_key
f2d4732908d59805d830a49d36974ac0
-
splitter
Y262SUCZ4UJJ
Signatures
-
Stops running service(s) 3 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
Processes:
flow ioc 20 pastebin.com 21 pastebin.com 23 0.tcp.eu.ngrok.io 69 0.tcp.eu.ngrok.io 75 0.tcp.eu.ngrok.io 83 0.tcp.eu.ngrok.io 103 0.tcp.eu.ngrok.io -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2352 sc.exe 1876 sc.exe 1668 sc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2508 powershell.exe 2508 powershell.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
powershell.exe97d72efbb1f6fea3f158b136c330689d.exedescription pid process Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: 33 1640 97d72efbb1f6fea3f158b136c330689d.exe Token: SeIncBasePriorityPrivilege 1640 97d72efbb1f6fea3f158b136c330689d.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
97d72efbb1f6fea3f158b136c330689d.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1640 wrote to memory of 2492 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 1640 wrote to memory of 2492 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 2492 wrote to memory of 2508 2492 cmd.exe powershell.exe PID 2492 wrote to memory of 2508 2492 cmd.exe powershell.exe PID 1640 wrote to memory of 5016 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 1640 wrote to memory of 5016 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 5016 wrote to memory of 1668 5016 cmd.exe sc.exe PID 5016 wrote to memory of 1668 5016 cmd.exe sc.exe PID 1640 wrote to memory of 3812 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 1640 wrote to memory of 3812 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 3812 wrote to memory of 2352 3812 cmd.exe sc.exe PID 3812 wrote to memory of 2352 3812 cmd.exe sc.exe PID 1640 wrote to memory of 4560 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 1640 wrote to memory of 4560 1640 97d72efbb1f6fea3f158b136c330689d.exe cmd.exe PID 4560 wrote to memory of 1876 4560 cmd.exe sc.exe PID 4560 wrote to memory of 1876 4560 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97d72efbb1f6fea3f158b136c330689d.exe"C:\Users\Admin\AppData\Local\Temp\97d72efbb1f6fea3f158b136c330689d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd /c sc query windefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc query windefend3⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop windefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop windefend3⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\cmd.execmd /c sc delete windefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete windefend3⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5hgckhx.y3w.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1640-4-0x000000001C000000-0x000000001C0A6000-memory.dmpFilesize
664KB
-
memory/1640-23-0x000000001D190000-0x000000001D22C000-memory.dmpFilesize
624KB
-
memory/1640-3-0x000000001B560000-0x000000001B57C000-memory.dmpFilesize
112KB
-
memory/1640-0-0x00007FFC94D65000-0x00007FFC94D66000-memory.dmpFilesize
4KB
-
memory/1640-26-0x00007FFC94AB0000-0x00007FFC95451000-memory.dmpFilesize
9.6MB
-
memory/1640-25-0x00007FFC94D65000-0x00007FFC94D66000-memory.dmpFilesize
4KB
-
memory/1640-2-0x00007FFC94AB0000-0x00007FFC95451000-memory.dmpFilesize
9.6MB
-
memory/1640-1-0x000000001BB30000-0x000000001BFFE000-memory.dmpFilesize
4.8MB
-
memory/1640-5-0x00007FFC94AB0000-0x00007FFC95451000-memory.dmpFilesize
9.6MB
-
memory/1640-24-0x000000001B630000-0x000000001B638000-memory.dmpFilesize
32KB
-
memory/2508-7-0x000001E067990000-0x000001E0679B2000-memory.dmpFilesize
136KB
-
memory/2508-22-0x00007FFC91340000-0x00007FFC91E01000-memory.dmpFilesize
10.8MB
-
memory/2508-19-0x00007FFC91340000-0x00007FFC91E01000-memory.dmpFilesize
10.8MB
-
memory/2508-18-0x00007FFC91340000-0x00007FFC91E01000-memory.dmpFilesize
10.8MB
-
memory/2508-6-0x00007FFC91343000-0x00007FFC91345000-memory.dmpFilesize
8KB
-
memory/2508-17-0x00007FFC91340000-0x00007FFC91E01000-memory.dmpFilesize
10.8MB