Overview
overview
10Static
static
7r-aimbot.exe
windows10-2004-x64
10r-aimbot.exe
windows11-21h2-x64
10fuck.exe
windows10-2004-x64
10fuck.exe
windows11-21h2-x64
10r-aimbot.exe
windows10-2004-x64
8r-aimbot.exe
windows11-21h2-x64
8WindowsApp...n4.exe
windows10-2004-x64
8WindowsApp...n4.exe
windows11-21h2-x64
8r-aimbot.exe
windows10-2004-x64
7r-aimbot.exe
windows11-21h2-x64
7Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/05/2024, 18:27
Behavioral task
behavioral1
Sample
r-aimbot.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
r-aimbot.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
fuck.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
fuck.exe
Resource
win11-20240426-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
r-aimbot.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
r-aimbot.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
WindowsApplication4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
WindowsApplication4.exe
Resource
win11-20240508-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
r-aimbot.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
r-aimbot.exe
Resource
win11-20240426-en
windows11-21h2-x64
General
-
Target
fuck.exe
-
Size
1.1MB
-
MD5
3ee6841e13ab3b14fb292f316d978b63
-
SHA1
a1350928f6a12013e087f8c3bf6ff19418f4de85
-
SHA256
da70a8f8696cd01ffa41596ed6c8ad6f880db3fc79a2955cb93ce9eec81059d9
-
SHA512
64ba822ac323ccbb4fd8d1d7ce67607086b2d6dd60f7699c260570ba7517329fba73389a2b6fada33da1b33d9f323d5c5b063652973f806b49ccfdbda54787ca
-
SSDEEP
24576:1CXYdVWtQjz9+S+YK/gm8iuViqJzJJZW6V4WdhrBWPsvj:LPWtAd+YK4m8rDJ+WbBEsvj
Malware Config
Extracted
njrat
im523
SteamGift__
masterlaith.publicvm.com:5552
88a41d3535aad80a532ad2e6fa138beb
-
reg_key
88a41d3535aad80a532ad2e6fa138beb
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1176 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\88a41d3535aad80a532ad2e6fa138beb.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\88a41d3535aad80a532ad2e6fa138beb.exe server.exe -
Executes dropped EXE 1 IoCs
pid Process 2116 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\88a41d3535aad80a532ad2e6fa138beb = "\"C:\\ProgramData\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\88a41d3535aad80a532ad2e6fa138beb = "\"C:\\ProgramData\\server.exe\" .." server.exe -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created F:\autorun.inf server.exe File opened for modification F:\autorun.inf server.exe File created C:\autorun.inf server.exe File opened for modification C:\autorun.inf server.exe File created D:\autorun.inf server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 3572 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe 2116 server.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2116 server.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2116 server.exe Token: SeDebugPrivilege 3572 taskkill.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe Token: 33 2116 server.exe Token: SeIncBasePriorityPrivilege 2116 server.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3768 wrote to memory of 2116 3768 fuck.exe 81 PID 3768 wrote to memory of 2116 3768 fuck.exe 81 PID 3768 wrote to memory of 2116 3768 fuck.exe 81 PID 2116 wrote to memory of 1176 2116 server.exe 82 PID 2116 wrote to memory of 1176 2116 server.exe 82 PID 2116 wrote to memory of 1176 2116 server.exe 82 PID 2116 wrote to memory of 3572 2116 server.exe 83 PID 2116 wrote to memory of 3572 2116 server.exe 83 PID 2116 wrote to memory of 3572 2116 server.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\fuck.exe"C:\Users\Admin\AppData\Local\Temp\fuck.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\ProgramData\server.exe"C:\ProgramData\server.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:1176
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD53ee6841e13ab3b14fb292f316d978b63
SHA1a1350928f6a12013e087f8c3bf6ff19418f4de85
SHA256da70a8f8696cd01ffa41596ed6c8ad6f880db3fc79a2955cb93ce9eec81059d9
SHA51264ba822ac323ccbb4fd8d1d7ce67607086b2d6dd60f7699c260570ba7517329fba73389a2b6fada33da1b33d9f323d5c5b063652973f806b49ccfdbda54787ca