Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2024 19:00
General
-
Target
Server.exe
-
Size
51KB
-
MD5
2a89b427e10511467cf742eba3758675
-
SHA1
19d85fe11811f595a82c5e621decbc80f1602f0e
-
SHA256
26cd492b508a81f4066fd2fdec29f38e3fff456b613d8e276e1ba43eadb622a2
-
SHA512
f9151cc648668da33f3a845817eb7ee9871f2954d7042a0fae218c80087735bec1734a226ed16eefa168c07971d24f826039d329c29055c9f4252553fad8242b
-
SSDEEP
768:BDId3QTv3wXTr2/4fsR5JP7eK69dA/BJf6yy:1Idg7+HpfsRqz9OJiz
Malware Config
Extracted
Family
njrat
Version
njRAT v0.7d Edition Syria
C2
विनी蒂I3LjमेuविनीC4x:NताU1粹g==
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|'|'|
Signatures
-
Njrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2028 Server.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: SeDebugPrivilege 4248 taskmgr.exe Token: SeSystemProfilePrivilege 4248 taskmgr.exe Token: SeCreateGlobalPrivilege 4248 taskmgr.exe Token: 33 4248 taskmgr.exe Token: SeIncBasePriorityPrivilege 4248 taskmgr.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe Token: 33 2028 Server.exe Token: SeIncBasePriorityPrivilege 2028 Server.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
pid Process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe 4248 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4248