General
-
Target
5DEBA3B3F7B4D814B066B0DED64E8F2B.exe
-
Size
23KB
-
Sample
240531-en3k7sfe88
-
MD5
5deba3b3f7b4d814b066b0ded64e8f2b
-
SHA1
fc39258768904173d713720e78f052d064072cdf
-
SHA256
a7a0a639b202e4c1cdff0d1763320403adbeacd621006ebd228a9a736fd56beb
-
SHA512
c9c24451a9255afae3a7f8e33d72af5a3060995902fe397967fe97b6e748e5a0e66278d6d303fdf616302ce3e2de389a12a744240f1e1d1dab19859a00834541
-
SSDEEP
384:Kc68yCaUVIhboNgfEimfkNeayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZWX:Y873kgNfxaf6ARpcnur
Behavioral task
behavioral1
Sample
5DEBA3B3F7B4D814B066B0DED64E8F2B.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5DEBA3B3F7B4D814B066B0DED64E8F2B.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
njrat
0.7d
Lammer
tcp.ngrok.io:443
d6444e9a3862bae350679ed05760fd64
-
reg_key
d6444e9a3862bae350679ed05760fd64
-
splitter
|'|'|
Targets
-
-
Target
5DEBA3B3F7B4D814B066B0DED64E8F2B.exe
-
Size
23KB
-
MD5
5deba3b3f7b4d814b066b0ded64e8f2b
-
SHA1
fc39258768904173d713720e78f052d064072cdf
-
SHA256
a7a0a639b202e4c1cdff0d1763320403adbeacd621006ebd228a9a736fd56beb
-
SHA512
c9c24451a9255afae3a7f8e33d72af5a3060995902fe397967fe97b6e748e5a0e66278d6d303fdf616302ce3e2de389a12a744240f1e1d1dab19859a00834541
-
SSDEEP
384:Kc68yCaUVIhboNgfEimfkNeayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZWX:Y873kgNfxaf6ARpcnur
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1