Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05-09-2024 01:42
Static task
static1
Behavioral task
behavioral1
Sample
b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe
Resource
win10v2004-20240802-en
General
-
Target
b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe
-
Size
25KB
-
MD5
0958b133909fd7e905bfdf6d07864afa
-
SHA1
70c2bbe1328cde44369a2468846acf221083f858
-
SHA256
b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8
-
SHA512
377e31e99476fd8fa5922ea04928539c943832919564526ec030cbb8ea91112a566d996462da655aab1b654c6123c7c7942b48e521c5864c1955981ecfaa6064
-
SSDEEP
768:svpjb780jOidrnhjRKPj/AJUu7V3yiEs8IsBy9RvPdOi:QjzjOah4jo62yiY9ByvVOi
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
0.tcp.eu.ngrok.io:18863
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe Update.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Discord.exe Update.exe -
Executes dropped EXE 3 IoCs
pid Process 2232 Update.exe 348 Server.exe 1656 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Update.exe\" .." Update.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Windows\\Update.exe\" .." Update.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 2 0.tcp.eu.ngrok.io 22 0.tcp.eu.ngrok.io 34 0.tcp.eu.ngrok.io -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Update.exe b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe File opened for modification C:\Windows\Update.exe Update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2752 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1232 b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe 2232 Update.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe Token: 33 2232 Update.exe Token: SeIncBasePriorityPrivilege 2232 Update.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2232 1232 b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe 30 PID 1232 wrote to memory of 2232 1232 b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe 30 PID 1232 wrote to memory of 2232 1232 b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe 30 PID 2232 wrote to memory of 2752 2232 Update.exe 32 PID 2232 wrote to memory of 2752 2232 Update.exe 32 PID 2232 wrote to memory of 2752 2232 Update.exe 32 PID 1904 wrote to memory of 348 1904 taskeng.exe 36 PID 1904 wrote to memory of 348 1904 taskeng.exe 36 PID 1904 wrote to memory of 348 1904 taskeng.exe 36 PID 1904 wrote to memory of 1656 1904 taskeng.exe 37 PID 1904 wrote to memory of 1656 1904 taskeng.exe 37 PID 1904 wrote to memory of 1656 1904 taskeng.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe"C:\Users\Admin\AppData\Local\Temp\b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\Update.exe"C:\Windows\Update.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Scheduled Task/Job: Scheduled Task
PID:2752
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {AC15A8F5-75D5-4D9C-AF26-7EE0FE725FB8} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
PID:348
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD50958b133909fd7e905bfdf6d07864afa
SHA170c2bbe1328cde44369a2468846acf221083f858
SHA256b0ae1dd93add4f91d67c516307541ffbeb8cb2696671d18248992f2ebdfb10d8
SHA512377e31e99476fd8fa5922ea04928539c943832919564526ec030cbb8ea91112a566d996462da655aab1b654c6123c7c7942b48e521c5864c1955981ecfaa6064