Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 14:16
Static task
static1
Behavioral task
behavioral1
Sample
0958B133909FD7E905BFDF6D07864AFA.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0958B133909FD7E905BFDF6D07864AFA.exe
Resource
win10v2004-20240802-en
General
-
Target
0958B133909FD7E905BFDF6D07864AFA.exe
-
Size
25KB
-
MD5
0958b133909fd7e905bfdf6d07864afa
-
SHA1
70c2bbe1328cde44369a2468846acf221083f858
-
SHA256
b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8
-
SHA512
377e31e99476fd8fa5922ea04928539c943832919564526ec030cbb8ea91112a566d996462da655aab1b654c6123c7c7942b48e521c5864c1955981ecfaa6064
-
SSDEEP
768:svpjb780jOidrnhjRKPj/AJUu7V3yiEs8IsBy9RvPdOi:QjzjOah4jo62yiY9ByvVOi
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.eu.ngrok.io:18863
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation 0958B133909FD7E905BFDF6D07864AFA.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe Update.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe Update.exe -
Executes dropped EXE 3 IoCs
pid Process 4532 Update.exe 344 Server.exe 1700 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Update.exe\" .." Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Update.exe\" .." Update.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 22 0.tcp.eu.ngrok.io 64 0.tcp.eu.ngrok.io 99 0.tcp.eu.ngrok.io -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Update.exe 0958B133909FD7E905BFDF6D07864AFA.exe File opened for modification C:\Windows\Update.exe Update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4492 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1168 0958B133909FD7E905BFDF6D07864AFA.exe 4532 Update.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe Token: 33 4532 Update.exe Token: SeIncBasePriorityPrivilege 4532 Update.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1168 wrote to memory of 4532 1168 0958B133909FD7E905BFDF6D07864AFA.exe 93 PID 1168 wrote to memory of 4532 1168 0958B133909FD7E905BFDF6D07864AFA.exe 93 PID 4532 wrote to memory of 4492 4532 Update.exe 97 PID 4532 wrote to memory of 4492 4532 Update.exe 97 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0958B133909FD7E905BFDF6D07864AFA.exe"C:\Users\Admin\AppData\Local\Temp\0958B133909FD7E905BFDF6D07864AFA.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\Update.exe"C:\Windows\Update.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Scheduled Task/Job: Scheduled Task
PID:4492
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:344
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:1700
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a8a147915e3a996fdbe10b3a3f1e1bb2
SHA1abc564c1be468d57e700913e7b6cf8f62d421263
SHA2568b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e
SHA51217b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c
-
Filesize
25KB
MD50958b133909fd7e905bfdf6d07864afa
SHA170c2bbe1328cde44369a2468846acf221083f858
SHA256b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8
SHA512377e31e99476fd8fa5922ea04928539c943832919564526ec030cbb8ea91112a566d996462da655aab1b654c6123c7c7942b48e521c5864c1955981ecfaa6064