Analysis
-
max time kernel
59s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
21/07/2024, 14:20
General
-
Target
NjRat 0.7D Green Edition by im523.exe
-
Size
2.5MB
-
MD5
db03ed78b35220d0a178d0c4cba27e76
-
SHA1
ba576c67c78c680e2f8c5375d294b5dbd7c3250e
-
SHA256
42b9c295089c7cf9141f5d0a40a1155cfd3627888579473f8c9b80e8e3ea1c48
-
SHA512
c272cfef5199450c903443ae3259191d1ecfd8795854e297aef36c819af8887233419b98bb54e5e5894846a1454c398991487547191c66de00881c31e6d1ae93
-
SSDEEP
49152:LJNiJe3T1/rgMVwPpIGGHgoQhLL2RWNbftLLQPFfO5SSOp:LJNReMVmILHg3gMQSjO
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 9 IoCs
-
Creates new service(s) 2 TTPs
-
Stops running service(s) 4 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 2 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"C:\Users\Admin\AppData\Local\Temp\NjRat 0.7D Green Edition by im523.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WAPQYYAB"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WAPQYYAB" binpath= "C:\ProgramData\evhjkmhsccca\ffhzguglhicn.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WAPQYYAB"2⤵
- Launches sc.exe
-
-
C:\ProgramData\evhjkmhsccca\ffhzguglhicn.exeC:\ProgramData\evhjkmhsccca\ffhzguglhicn.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5db03ed78b35220d0a178d0c4cba27e76
SHA1ba576c67c78c680e2f8c5375d294b5dbd7c3250e
SHA25642b9c295089c7cf9141f5d0a40a1155cfd3627888579473f8c9b80e8e3ea1c48
SHA512c272cfef5199450c903443ae3259191d1ecfd8795854e297aef36c819af8887233419b98bb54e5e5894846a1454c398991487547191c66de00881c31e6d1ae93
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
1.6MB