Resubmissions
31/05/2024, 16:14
240531-tp1wbsdf8s1031/05/2024, 16:11
240531-tm9qfsec731031/05/2024, 16:06
240531-tj5mbsde3t10Analysis
- max time kernel
142s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
31/05/2024, 16:11
Static task
static1
Behavioral task
behavioral1
Sample
akrien_1.5.8.rar
Resource
win7-20240221-en
windows7-x64
5 signatures
300 seconds
General
- Target akrien_1.5.8.rar
- Size 31KB
- Sample240531-tm9qfsec73
- SHA256 01897bed0d01dbedd642a788244be6e178b5f049600aa6241572a2a19f7b4781
- MD5 0616222604d7b733cbc9251fe6fcaac4
- SHA1 3f3d16ec658f869d90b2126f51e0c6a5756d7c88
- SHA512 f0dc202d9a32c4d75c3ad07ee41fc405f5267db7e056b2e535ece8b26d638ecfec16d201d8f3ef594f7dd26bcdcb9c3ab1e0013fdb631450c7d18af471ba6f44
- SSDEEP 768:Zv7405+c6z9+20s6SdHRZI0Wu89XveC2a6RRy610UEnSlb2Y:h7eu23xktvWRvtaGX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
FBR
C2
-
hakim32.ddns.net:2000
-
2.tcp.eu.ngrok.io:17169
Mutex
-
943103c6c88219ab23c2a39b264fc150
Attributes
-
reg_key
943103c6c88219ab23c2a39b264fc150
-
splitter
|'|'|
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3920 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cmd.exe - Drops startup file 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe akrien 1.5.8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe akrien 1.5.8.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\microsoft corporation.exe taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\943103c6c88219ab23c2a39b264fc150Windows Update.exe akrien 1.5.8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\943103c6c88219ab23c2a39b264fc150Windows Update.exe akrien 1.5.8.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\943103c6c88219ab23c2a39b264fc150windows update.exe taskmgr.exe - Executes dropped EXE 1 IoCs
pid Process 1968 akrien 1.5.8.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 49 2.tcp.eu.ngrok.io - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf akrien 1.5.8.exe File created F:\autorun.inf akrien 1.5.8.exe File opened for modification F:\autorun.inf akrien 1.5.8.exe File created C:\autorun.inf akrien 1.5.8.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1620 7zFM.exe 1968 akrien 1.5.8.exe - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeRestorePrivilege 1620 7zFM.exe Token: 35 1620 7zFM.exe Token: SeSecurityPrivilege 1620 7zFM.exe Token: SeDebugPrivilege 3092 taskmgr.exe Token: SeSystemProfilePrivilege 3092 taskmgr.exe Token: SeCreateGlobalPrivilege 3092 taskmgr.exe Token: SeDebugPrivilege 1968 akrien 1.5.8.exe Token: 33 1968 akrien 1.5.8.exe Token: SeIncBasePriorityPrivilege 1968 akrien 1.5.8.exe Token: 33 1968 akrien 1.5.8.exe Token: SeIncBasePriorityPrivilege 1968 akrien 1.5.8.exe Token: 33 1968 akrien 1.5.8.exe Token: SeIncBasePriorityPrivilege 1968 akrien 1.5.8.exe Token: 33 1968 akrien 1.5.8.exe Token: SeIncBasePriorityPrivilege 1968 akrien 1.5.8.exe Token: 33 3092 taskmgr.exe Token: SeIncBasePriorityPrivilege 3092 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1620 7zFM.exe 1620 7zFM.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe 3092 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3076 wrote to memory of 1620 3076 cmd.exe 92 PID 3076 wrote to memory of 1620 3076 cmd.exe 92 PID 1968 wrote to memory of 3920 1968 akrien 1.5.8.exe 106 PID 1968 wrote to memory of 3920 1968 akrien 1.5.8.exe 106 PID 1968 wrote to memory of 3920 1968 akrien 1.5.8.exe 106
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\akrien_1.5.8.rar1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\akrien_1.5.8.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1620
-
-
C:\Users\Admin\Desktop\akrien 1.5.8.exe"C:\Users\Admin\Desktop\akrien 1.5.8.exe"1⤵
- Drops startup file
- Executes dropped EXE
- Drops autorun.inf file
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\akrien 1.5.8.exe" "akrien 1.5.8.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:3144
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Desktop\akrien 1.5.8.exe
- Size 93KB
- SHA256 1f2686b28c4b61cfe561638b0efe63423257bd85888952c39315103da280adbc
- MD5 ed3147efdd56b483af8c8b6f92b497d8
- SHA1 71824496d9bc96f28e2bed78221068846855d298
- SHA512 2082f964050dc30b60d9f4618b9002631bef31feb27fa98c2e36c32b214e6d4d3ee579055a9955e19d15d0ac8180885cd2605e11040f214e539ac35f8c78f19d
- SSDEEP 768:LY3LMO5hWXxyFcxovUKUJuROprXtwNzeYhYbmXxrjEtCdnl2pi1Rz4Rk3hsGdp73:JOHWhIUKcuOJgPhBjEwzGi1dDxD7gS
- MD5 SHA1 SHA512 SSDEEP