Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
20/08/2024, 12:16
Behavioral task
behavioral1
Sample
501cd09125b0d60c8612ee07d41aa6e0.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
General
- Target 501cd09125b0d60c8612ee07d41aa6e0.exe
- Size 134KB
- Sample240820-pff3ca1djc
- SHA256 0ff34979bd780fdaabef5d9f97d20499ef8c60aaf7e82200c822894d8ecd8cb5
- MD5 501cd09125b0d60c8612ee07d41aa6e0
- SHA1 6329eefcf56c8c85ed09b6b712d00593293e3a9f
- SHA512 0d95d57682b901228d7db039bfd24b1a3daa699068be25d19d71a68d5c31d06690c4a670beb7ad0e0c9ba1d4096b051d215aec0d6984873c90b4cc8c983d1786
- SSDEEP 3072:D4DnQ2WADWwsNMDAXExI3pmKFMMMMMMMMMMMMMMMMMMqk0MMMMMMMMMMMMMMMMMV:D4UDDvMSMMMMMMMMMMMMMMMMMMqk0MMu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
Sazan
C2
-
84.32.231.176:1610
Mutex
-
5f1f65bec0cfed61b046be01c3f0b40e
Attributes
-
reg_key
5f1f65bec0cfed61b046be01c3f0b40e
-
splitter
Y262SUCZ4UJJ
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f1f65bec0cfed61b046be01c3f0b40e.exe 501cd09125b0d60c8612ee07d41aa6e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5f1f65bec0cfed61b046be01c3f0b40e.exe 501cd09125b0d60c8612ee07d41aa6e0.exe - Executes dropped EXE 2 IoCs
pid Process 2292 501cd09125b0d60c8612ee07d41aa6e0.exe 4092 501cd09125b0d60c8612ee07d41aa6e0.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5f1f65bec0cfed61b046be01c3f0b40e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\501cd09125b0d60c8612ee07d41aa6e0.exe\" .." 501cd09125b0d60c8612ee07d41aa6e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5f1f65bec0cfed61b046be01c3f0b40e = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\501cd09125b0d60c8612ee07d41aa6e0.exe\" .." 501cd09125b0d60c8612ee07d41aa6e0.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 501cd09125b0d60c8612ee07d41aa6e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 501cd09125b0d60c8612ee07d41aa6e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 501cd09125b0d60c8612ee07d41aa6e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 380 reg.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4792 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 3944 501cd09125b0d60c8612ee07d41aa6e0.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3944 501cd09125b0d60c8612ee07d41aa6e0.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeDebugPrivilege 2292 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeDebugPrivilege 4092 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: 33 3944 501cd09125b0d60c8612ee07d41aa6e0.exe Token: SeIncBasePriorityPrivilege 3944 501cd09125b0d60c8612ee07d41aa6e0.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3944 wrote to memory of 1180 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 95 PID 3944 wrote to memory of 1180 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 95 PID 3944 wrote to memory of 1180 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 95 PID 3944 wrote to memory of 2428 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 97 PID 3944 wrote to memory of 2428 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 97 PID 3944 wrote to memory of 2428 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 97 PID 3944 wrote to memory of 4792 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 99 PID 3944 wrote to memory of 4792 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 99 PID 3944 wrote to memory of 4792 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 99 PID 3944 wrote to memory of 4584 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 101 PID 3944 wrote to memory of 4584 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 101 PID 3944 wrote to memory of 4584 3944 501cd09125b0d60c8612ee07d41aa6e0.exe 101 PID 4584 wrote to memory of 380 4584 cmd.exe 103 PID 4584 wrote to memory of 380 4584 cmd.exe 103 PID 4584 wrote to memory of 380 4584 cmd.exe 103 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1180 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe"C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1180
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn CleanSweepCheck /f2⤵
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn CleanSweepCheck /tr C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4792
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\reg.exereg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:380
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4400,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:81⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exeC:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exeC:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4092
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\501cd09125b0d60c8612ee07d41aa6e0.exe.log
- Size 319B
- SHA256 7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
- MD5 da4fafeffe21b7cb3a8c170ca7911976
- SHA1 50ef77e2451ab60f93f4db88325b897d215be5ad
- SHA512 0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\501cd09125b0d60c8612ee07d41aa6e0.exe
- Size 134KB
- SHA256 0ff34979bd780fdaabef5d9f97d20499ef8c60aaf7e82200c822894d8ecd8cb5
- MD5 501cd09125b0d60c8612ee07d41aa6e0
- SHA1 6329eefcf56c8c85ed09b6b712d00593293e3a9f
- SHA512 0d95d57682b901228d7db039bfd24b1a3daa699068be25d19d71a68d5c31d06690c4a670beb7ad0e0c9ba1d4096b051d215aec0d6984873c90b4cc8c983d1786
- SSDEEP 3072:D4DnQ2WADWwsNMDAXExI3pmKFMMMMMMMMMMMMMMMMMMqk0MMMMMMMMMMMMMMMMMV:D4UDDvMSMMMMMMMMMMMMMMMMMMqk0MMu
- MD5 SHA1 SHA512 SSDEEP