Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 12:28
Static task
static1
Behavioral task
behavioral1
Sample
23dd4610693bb9928f8c224440ad8e30N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
23dd4610693bb9928f8c224440ad8e30N.exe
Resource
win10v2004-20240802-en
General
-
Target
23dd4610693bb9928f8c224440ad8e30N.exe
-
Size
1.3MB
-
MD5
23dd4610693bb9928f8c224440ad8e30
-
SHA1
2bd398fbd6bb00801a5ac15650afcff4e3b7ee8c
-
SHA256
35b588651334998c6473ba19b676527e5e4782a5d366e5aee5f6151e927ef1b5
-
SHA512
9b3f635e105c41dd93f806cbe09cd73a4585f26ed6ff349d21862fdd4d3990e3bc701a0199eed9969eb101691a8363234e67f134a4d86ac397ff528276970c3c
-
SSDEEP
24576:tfZlf2TdDY5LI6jrXDHt4D4lfLBSDm9kN4wIa7LwQVZjI6jZZjI6jVqOb/trJYwZ:TeyBgV
Malware Config
Extracted
njrat
im523
HacKed
maestro49.ddns.net:5552
1f14d442afed773c814b9d245e6118bf
-
reg_key
1f14d442afed773c814b9d245e6118bf
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2840 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1f14d442afed773c814b9d245e6118bf.exe ProcessHacker.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1f14d442afed773c814b9d245e6118bf.exe ProcessHacker.exe -
Executes dropped EXE 1 IoCs
pid Process 2176 ProcessHacker.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\1f14d442afed773c814b9d245e6118bf = "\"C:\\Users\\Admin\\AppData\\Roaming\\ProcessHacker.exe\" .." ProcessHacker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1f14d442afed773c814b9d245e6118bf = "\"C:\\Users\\Admin\\AppData\\Roaming\\ProcessHacker.exe\" .." ProcessHacker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Kills process with taskkill 1 IoCs
pid Process 2884 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2176 ProcessHacker.exe Token: SeDebugPrivilege 2884 taskkill.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe Token: 33 2176 ProcessHacker.exe Token: SeIncBasePriorityPrivilege 2176 ProcessHacker.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2176 2072 23dd4610693bb9928f8c224440ad8e30N.exe 30 PID 2072 wrote to memory of 2176 2072 23dd4610693bb9928f8c224440ad8e30N.exe 30 PID 2072 wrote to memory of 2176 2072 23dd4610693bb9928f8c224440ad8e30N.exe 30 PID 2176 wrote to memory of 2840 2176 ProcessHacker.exe 32 PID 2176 wrote to memory of 2840 2176 ProcessHacker.exe 32 PID 2176 wrote to memory of 2840 2176 ProcessHacker.exe 32 PID 2176 wrote to memory of 2884 2176 ProcessHacker.exe 33 PID 2176 wrote to memory of 2884 2176 ProcessHacker.exe 33 PID 2176 wrote to memory of 2884 2176 ProcessHacker.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\23dd4610693bb9928f8c224440ad8e30N.exe"C:\Users\Admin\AppData\Local\Temp\23dd4610693bb9928f8c224440ad8e30N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Roaming\ProcessHacker.exe"C:\Users\Admin\AppData\Roaming\ProcessHacker.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\ProcessHacker.exe" "ProcessHacker.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2840
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Exsample.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2884
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD523dd4610693bb9928f8c224440ad8e30
SHA12bd398fbd6bb00801a5ac15650afcff4e3b7ee8c
SHA25635b588651334998c6473ba19b676527e5e4782a5d366e5aee5f6151e927ef1b5
SHA5129b3f635e105c41dd93f806cbe09cd73a4585f26ed6ff349d21862fdd4d3990e3bc701a0199eed9969eb101691a8363234e67f134a4d86ac397ff528276970c3c