Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 22:04
Behavioral task
behavioral1
Sample
WTLDR.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
WTLDR.exe
Resource
win10v2004-20240508-en
General
-
Target
WTLDR.exe
-
Size
31KB
-
MD5
7a94013c17dc892cea16fbae38646e43
-
SHA1
8cf54c2ac961dd5c82cb3b07c3de317847aa94bb
-
SHA256
cd35af0a0c71c382760409b7b2343c83857d89af55a0b365b72962f0f9c9a400
-
SHA512
03df47db51270ca87172620e5475ce7a99e1fa1bd61e1956e4a0b28792d145b4e30d5b0d7b0737ea3ed331cecaecde78641b4828b1b9425153b1f9ac3de6f34a
-
SSDEEP
768:jrpS7G1XB9Qzxry1vIPvQbxvKnQmIDUu0tinaj:Um6yxIQVk7j
Malware Config
Extracted
njrat
0.7d
windowsdefender
88.168.211.65:6522
9300538b8eb52046b545ea0eefc265d2
-
reg_key
9300538b8eb52046b545ea0eefc265d2
-
splitter
Y262SUCZ4UJJ
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2812 netsh.exe 2756 netsh.exe -
Drops startup file 2 IoCs
Processes:
chrome_protect.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9300538b8eb52046b545ea0eefc265d2.exe chrome_protect.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9300538b8eb52046b545ea0eefc265d2.exe chrome_protect.exe -
Executes dropped EXE 1 IoCs
Processes:
chrome_protect.exepid process 2064 chrome_protect.exe -
Loads dropped DLL 1 IoCs
Processes:
WTLDR.exepid process 2020 WTLDR.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chrome_protect.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\9300538b8eb52046b545ea0eefc265d2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome_protect.exe\" .." chrome_protect.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\9300538b8eb52046b545ea0eefc265d2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\chrome_protect.exe\" .." chrome_protect.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exenetsh.exedescription ioc process Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WTLDR.exepid process 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe 2020 WTLDR.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WTLDR.exechrome_protect.exedescription pid process Token: SeDebugPrivilege 2020 WTLDR.exe Token: SeDebugPrivilege 2064 chrome_protect.exe Token: 33 2064 chrome_protect.exe Token: SeIncBasePriorityPrivilege 2064 chrome_protect.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
WTLDR.exechrome_protect.execmd.exedescription pid process target process PID 2020 wrote to memory of 2064 2020 WTLDR.exe chrome_protect.exe PID 2020 wrote to memory of 2064 2020 WTLDR.exe chrome_protect.exe PID 2020 wrote to memory of 2064 2020 WTLDR.exe chrome_protect.exe PID 2020 wrote to memory of 2064 2020 WTLDR.exe chrome_protect.exe PID 2064 wrote to memory of 2812 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2812 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2812 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2812 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2756 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2756 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2756 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 2756 2064 chrome_protect.exe netsh.exe PID 2064 wrote to memory of 1960 2064 chrome_protect.exe cmd.exe PID 2064 wrote to memory of 1960 2064 chrome_protect.exe cmd.exe PID 2064 wrote to memory of 1960 2064 chrome_protect.exe cmd.exe PID 2064 wrote to memory of 1960 2064 chrome_protect.exe cmd.exe PID 1960 wrote to memory of 1820 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1820 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1820 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1820 1960 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\WTLDR.exe"C:\Users\Admin\AppData\Local\Temp\WTLDR.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe" "chrome_protect.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2812 -
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 0 -n 2 & del "C:\Users\Admin\AppData\Local\Temp\chrome_protect.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\PING.EXEping 0 -n 24⤵
- Runs ping.exe
PID:1820
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD57a94013c17dc892cea16fbae38646e43
SHA18cf54c2ac961dd5c82cb3b07c3de317847aa94bb
SHA256cd35af0a0c71c382760409b7b2343c83857d89af55a0b365b72962f0f9c9a400
SHA51203df47db51270ca87172620e5475ce7a99e1fa1bd61e1956e4a0b28792d145b4e30d5b0d7b0737ea3ed331cecaecde78641b4828b1b9425153b1f9ac3de6f34a