Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20-07-2024 04:57
Static task
static1
Behavioral task
behavioral1
Sample
50454d6954463f1a1971d4f3714b62e0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
50454d6954463f1a1971d4f3714b62e0N.exe
Resource
win10v2004-20240709-en
General
-
Target
50454d6954463f1a1971d4f3714b62e0N.exe
-
Size
8.7MB
-
MD5
50454d6954463f1a1971d4f3714b62e0
-
SHA1
2b3a9a4c30f6d15fedfaba0dd9f5cbf4c2f9df38
-
SHA256
2a2b536fc29312cedbe7cbb445c2a8dbeaf1b7de929b8744dbc0bc317ffe325d
-
SHA512
3862e6b144d387c6b3594b79ed830e5dc35114b2c28c8df62762a72bf175b748df5d2bd2b4daf15af06be9111458dd201144c1a8139e411f69ba64d5a2e9d3c0
-
SSDEEP
196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbI:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGm8
Malware Config
Extracted
njrat
0.7d
jjj
youri.mooo.com:1605
e936a10f968ac948cd351c9629dbd36d
-
reg_key
e936a10f968ac948cd351c9629dbd36d
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2344 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 2772 winmgr107.exe 2784 winmgr107.exe -
Loads dropped DLL 1 IoCs
pid Process 2160 50454d6954463f1a1971d4f3714b62e0N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" winmgr107.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr107.exe" 50454d6954463f1a1971d4f3714b62e0N.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0009000000015e2f-15.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2772 set thread context of 2592 2772 winmgr107.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
NTFS ADS 3 IoCs
description ioc Process File opened for modification C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe File created C:\Users\Admin\AppData\Local\Temp\50454d6954463f1a1971d4f3714b62e0N.exe:Zone.Identifier:$DATA 50454d6954463f1a1971d4f3714b62e0N.exe File created C:\ProgramData\winmgr107.exe:Zone.Identifier:$DATA winmgr107.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 324 schtasks.exe 1740 schtasks.exe 2448 schtasks.exe 2256 schtasks.exe 2528 schtasks.exe 1752 schtasks.exe 1760 schtasks.exe 2312 schtasks.exe 2016 schtasks.exe 1092 schtasks.exe 3060 schtasks.exe 2688 schtasks.exe 1964 schtasks.exe 1164 schtasks.exe 580 schtasks.exe 2936 schtasks.exe 1312 schtasks.exe 2492 schtasks.exe 2516 schtasks.exe 1408 schtasks.exe 1988 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2160 50454d6954463f1a1971d4f3714b62e0N.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2784 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe 2772 winmgr107.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe Token: 33 2592 RegAsm.exe Token: SeIncBasePriorityPrivilege 2592 RegAsm.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2072 2160 50454d6954463f1a1971d4f3714b62e0N.exe 30 PID 2160 wrote to memory of 2072 2160 50454d6954463f1a1971d4f3714b62e0N.exe 30 PID 2160 wrote to memory of 2072 2160 50454d6954463f1a1971d4f3714b62e0N.exe 30 PID 2160 wrote to memory of 2072 2160 50454d6954463f1a1971d4f3714b62e0N.exe 30 PID 2072 wrote to memory of 2180 2072 cmd.exe 32 PID 2072 wrote to memory of 2180 2072 cmd.exe 32 PID 2072 wrote to memory of 2180 2072 cmd.exe 32 PID 2072 wrote to memory of 2180 2072 cmd.exe 32 PID 2160 wrote to memory of 2772 2160 50454d6954463f1a1971d4f3714b62e0N.exe 33 PID 2160 wrote to memory of 2772 2160 50454d6954463f1a1971d4f3714b62e0N.exe 33 PID 2160 wrote to memory of 2772 2160 50454d6954463f1a1971d4f3714b62e0N.exe 33 PID 2160 wrote to memory of 2772 2160 50454d6954463f1a1971d4f3714b62e0N.exe 33 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2592 2772 winmgr107.exe 34 PID 2772 wrote to memory of 2688 2772 winmgr107.exe 35 PID 2772 wrote to memory of 2688 2772 winmgr107.exe 35 PID 2772 wrote to memory of 2688 2772 winmgr107.exe 35 PID 2772 wrote to memory of 2688 2772 winmgr107.exe 35 PID 2772 wrote to memory of 2492 2772 winmgr107.exe 37 PID 2772 wrote to memory of 2492 2772 winmgr107.exe 37 PID 2772 wrote to memory of 2492 2772 winmgr107.exe 37 PID 2772 wrote to memory of 2492 2772 winmgr107.exe 37 PID 2592 wrote to memory of 2344 2592 RegAsm.exe 39 PID 2592 wrote to memory of 2344 2592 RegAsm.exe 39 PID 2592 wrote to memory of 2344 2592 RegAsm.exe 39 PID 2592 wrote to memory of 2344 2592 RegAsm.exe 39 PID 2772 wrote to memory of 2256 2772 winmgr107.exe 41 PID 2772 wrote to memory of 2256 2772 winmgr107.exe 41 PID 2772 wrote to memory of 2256 2772 winmgr107.exe 41 PID 2772 wrote to memory of 2256 2772 winmgr107.exe 41 PID 2772 wrote to memory of 2516 2772 winmgr107.exe 43 PID 2772 wrote to memory of 2516 2772 winmgr107.exe 43 PID 2772 wrote to memory of 2516 2772 winmgr107.exe 43 PID 2772 wrote to memory of 2516 2772 winmgr107.exe 43 PID 2772 wrote to memory of 2528 2772 winmgr107.exe 45 PID 2772 wrote to memory of 2528 2772 winmgr107.exe 45 PID 2772 wrote to memory of 2528 2772 winmgr107.exe 45 PID 2772 wrote to memory of 2528 2772 winmgr107.exe 45 PID 2772 wrote to memory of 1408 2772 winmgr107.exe 47 PID 2772 wrote to memory of 1408 2772 winmgr107.exe 47 PID 2772 wrote to memory of 1408 2772 winmgr107.exe 47 PID 2772 wrote to memory of 1408 2772 winmgr107.exe 47 PID 2772 wrote to memory of 2312 2772 winmgr107.exe 49 PID 2772 wrote to memory of 2312 2772 winmgr107.exe 49 PID 2772 wrote to memory of 2312 2772 winmgr107.exe 49 PID 2772 wrote to memory of 2312 2772 winmgr107.exe 49 PID 2772 wrote to memory of 2016 2772 winmgr107.exe 51 PID 2772 wrote to memory of 2016 2772 winmgr107.exe 51 PID 2772 wrote to memory of 2016 2772 winmgr107.exe 51 PID 2772 wrote to memory of 2016 2772 winmgr107.exe 51 PID 2772 wrote to memory of 1988 2772 winmgr107.exe 53 PID 2772 wrote to memory of 1988 2772 winmgr107.exe 53 PID 2772 wrote to memory of 1988 2772 winmgr107.exe 53 PID 2772 wrote to memory of 1988 2772 winmgr107.exe 53 PID 2772 wrote to memory of 1752 2772 winmgr107.exe 55 PID 2772 wrote to memory of 1752 2772 winmgr107.exe 55 PID 2772 wrote to memory of 1752 2772 winmgr107.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\50454d6954463f1a1971d4f3714b62e0N.exe"C:\Users\Admin\AppData\Local\Temp\50454d6954463f1a1971d4f3714b62e0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\PROGRA~3\50454D~1.TXT2⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\50454d6954463f1a1971d4f3714b62e0N.exe.txt3⤵PID:2180
-
-
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe03⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2344
-
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2688
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2492
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2256
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2516
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2528
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1408
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2312
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2016
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1988
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1752
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1760
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1964
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:324
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1164
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1312
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:580
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1092
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1740
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:3060
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2448
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {42EAF562-E836-4BFF-9364-CF653CF9BE49} S-1-5-21-940600906-3464502421-4240639183-1000:MGWWAYYN\Admin:Interactive:[1]1⤵PID:2544
-
C:\ProgramData\winmgr107.exeC:\ProgramData\winmgr107.exe2⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
992B
MD5c8cf7247d4cfc99a7582a42d13df4c08
SHA1317f5588af0b3b6374c436fb00084c522fd78a83
SHA25678bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0
SHA5125dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357
-
Filesize
8.7MB
MD5b4d0123a1d9b0b2523504df45d689401
SHA1c9d5aec232d42e32d0e5fa1c1542c05545baeb90
SHA25665376ee04b618d0903627ac2c5531243b1bad81a467034c6c1dfe6690a293d6c
SHA512ec09d8ac2465f3f5813242ed59b1691936c903099969264685ded60a65cccf2d816f9018a0b8b34096c80a9b07a7585349453433a2421b5740522f8c0cd5c10a