Analysis
-
max time kernel
129s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 14:59
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
New Client.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
New Client.exe
Resource
win11-20241007-en
Errors
General
-
Target
New Client.exe
-
Size
65KB
-
MD5
418617925234cf8529050924c905963c
-
SHA1
d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91
-
SHA256
6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8
-
SHA512
e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415
-
SSDEEP
1536:efqK4Tm4BoN36t4QviFw1AjHkBnvbKfLteF3nLrB9z3nIaF9bHS9vM:efqK4C4BoN36t4QviFC8EBnefWl9zYaL
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:36811
svhost.exe
-
reg_key
svhost.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2516 cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
svhost.exesvhost.exesvhost.exepid process 2636 svhost.exe 1240 svhost.exe 1268 svhost.exe -
Loads dropped DLL 1 IoCs
Processes:
New Client.exepid process 2380 New Client.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .." svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .." svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exeschtasks.exesvhost.exesvhost.exeshutdown.exeNew Client.exesvhost.exechoice.exetaskkill.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2684 taskkill.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
svhost.exeshutdown.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: 33 2636 svhost.exe Token: SeIncBasePriorityPrivilege 2636 svhost.exe Token: SeShutdownPrivilege 788 shutdown.exe Token: SeRemoteShutdownPrivilege 788 shutdown.exe Token: 33 1744 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1744 AUDIODG.EXE Token: 33 1744 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1744 AUDIODG.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
New Client.execmd.exesvhost.exetaskeng.exedescription pid process target process PID 2380 wrote to memory of 2636 2380 New Client.exe svhost.exe PID 2380 wrote to memory of 2636 2380 New Client.exe svhost.exe PID 2380 wrote to memory of 2636 2380 New Client.exe svhost.exe PID 2380 wrote to memory of 2636 2380 New Client.exe svhost.exe PID 2380 wrote to memory of 2516 2380 New Client.exe cmd.exe PID 2380 wrote to memory of 2516 2380 New Client.exe cmd.exe PID 2380 wrote to memory of 2516 2380 New Client.exe cmd.exe PID 2380 wrote to memory of 2516 2380 New Client.exe cmd.exe PID 2516 wrote to memory of 3068 2516 cmd.exe choice.exe PID 2516 wrote to memory of 3068 2516 cmd.exe choice.exe PID 2516 wrote to memory of 3068 2516 cmd.exe choice.exe PID 2516 wrote to memory of 3068 2516 cmd.exe choice.exe PID 2636 wrote to memory of 2684 2636 svhost.exe taskkill.exe PID 2636 wrote to memory of 2684 2636 svhost.exe taskkill.exe PID 2636 wrote to memory of 2684 2636 svhost.exe taskkill.exe PID 2636 wrote to memory of 2684 2636 svhost.exe taskkill.exe PID 2636 wrote to memory of 2872 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2872 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2872 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2872 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2716 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2716 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2716 2636 svhost.exe schtasks.exe PID 2636 wrote to memory of 2716 2636 svhost.exe schtasks.exe PID 1800 wrote to memory of 1240 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1240 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1240 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1240 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1268 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1268 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1268 1800 taskeng.exe svhost.exe PID 1800 wrote to memory of 1268 1800 taskeng.exe svhost.exe PID 2636 wrote to memory of 788 2636 svhost.exe shutdown.exe PID 2636 wrote to memory of 788 2636 svhost.exe shutdown.exe PID 2636 wrote to memory of 788 2636 svhost.exe shutdown.exe PID 2636 wrote to memory of 788 2636 svhost.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f im Wireshark.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2684 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f3⤵
- System Location Discovery: System Language Discovery
PID:2872 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2716 -
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 003⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:3068
-
C:\Windows\system32\taskeng.exetaskeng.exe {8BA1DE54-3E3B-4C85-8DEB-CE9CD747BC0A} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\svhost.exeC:\Users\Admin\AppData\Local\Temp\svhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\svhost.exeC:\Users\Admin\AppData\Local\Temp\svhost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1492
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5401⤵
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2320
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5418617925234cf8529050924c905963c
SHA1d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91
SHA2566db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8
SHA512e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415