Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-09-2024 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe
-
Size
8.8MB
-
MD5
24aaa69f6e96ea14e0602d49d5c58a83
-
SHA1
d50b28c15f5a93a9e4679d3c43d88a17e7350f40
-
SHA256
3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f
-
SHA512
35f59bbd359371c9a584556899fa3990b2954a532b8d73e9b65282301b25bb3f32a218fcd19eba0aa473e5ab4cae21bba5f20584218f3800cc566534e007978c
-
SSDEEP
196608:eYzQO9kPmWdJGlvIGEBhQ7BP5TmoaiZMSW0G6JmJfLknzB:5zQ8kP9dgwXK7Lmo7ul8cTaB
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
clien
C2
hakim32.ddns.net:2000
147.185.221.18:61276
Mutex
f7e6d24b4a113d9753558dfbb032c2ac
Attributes
-
reg_key
f7e6d24b4a113d9753558dfbb032c2ac
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2432 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: 33 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe Token: SeIncBasePriorityPrivilege 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2432 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 31 PID 2136 wrote to memory of 2432 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 31 PID 2136 wrote to memory of 2432 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 31 PID 2136 wrote to memory of 2432 2136 3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe"C:\Users\Admin\AppData\Local\Temp\3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe" "3318d2024f5863942ba46235834bea85161a90219dbcb09bfadaf14f4811476f.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2432
-