Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 15:30
Static task
static1
Behavioral task
behavioral1
Sample
0958B133909FD7E905BFDF6D07864AFA.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0958B133909FD7E905BFDF6D07864AFA.exe
Resource
win10v2004-20240802-en
General
-
Target
0958B133909FD7E905BFDF6D07864AFA.exe
-
Size
25KB
-
MD5
0958b133909fd7e905bfdf6d07864afa
-
SHA1
70c2bbe1328cde44369a2468846acf221083f858
-
SHA256
b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8
-
SHA512
377e31e99476fd8fa5922ea04928539c943832919564526ec030cbb8ea91112a566d996462da655aab1b654c6123c7c7942b48e521c5864c1955981ecfaa6064
-
SSDEEP
768:svpjb780jOidrnhjRKPj/AJUu7V3yiEs8IsBy9RvPdOi:QjzjOah4jo62yiY9ByvVOi
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.eu.ngrok.io:18863
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 0958B133909FD7E905BFDF6D07864AFA.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe Update.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe Update.exe -
Executes dropped EXE 3 IoCs
pid Process 3680 Update.exe 4008 Server.exe 664 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Update.exe\" .." Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Update.exe\" .." Update.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 18 0.tcp.eu.ngrok.io 60 0.tcp.eu.ngrok.io 94 0.tcp.eu.ngrok.io -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Update.exe 0958B133909FD7E905BFDF6D07864AFA.exe File opened for modification C:\Windows\Update.exe Update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3076 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2724 0958B133909FD7E905BFDF6D07864AFA.exe 3680 Update.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe Token: 33 3680 Update.exe Token: SeIncBasePriorityPrivilege 3680 Update.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 3680 2724 0958B133909FD7E905BFDF6D07864AFA.exe 90 PID 2724 wrote to memory of 3680 2724 0958B133909FD7E905BFDF6D07864AFA.exe 90 PID 3680 wrote to memory of 3076 3680 Update.exe 94 PID 3680 wrote to memory of 3076 3680 Update.exe 94 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0958B133909FD7E905BFDF6D07864AFA.exe"C:\Users\Admin\AppData\Local\Temp\0958B133909FD7E905BFDF6D07864AFA.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\Update.exe"C:\Windows\Update.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Scheduled Task/Job: Scheduled Task
PID:3076
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:4008
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
PID:664
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a8a147915e3a996fdbe10b3a3f1e1bb2
SHA1abc564c1be468d57e700913e7b6cf8f62d421263
SHA2568b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e
SHA51217b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c
-
Filesize
25KB
MD50958b133909fd7e905bfdf6d07864afa
SHA170c2bbe1328cde44369a2468846acf221083f858
SHA256b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8
SHA512377e31e99476fd8fa5922ea04928539c943832919564526ec030cbb8ea91112a566d996462da655aab1b654c6123c7c7942b48e521c5864c1955981ecfaa6064