Analysis
-
max time kernel
128s -
max time network
130s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
29-10-2024 14:59
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
New Client.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
New Client.exe
Resource
win11-20241007-en
Errors
General
-
Target
New Client.exe
-
Size
65KB
-
MD5
418617925234cf8529050924c905963c
-
SHA1
d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91
-
SHA256
6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8
-
SHA512
e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415
-
SSDEEP
1536:efqK4Tm4BoN36t4QviFw1AjHkBnvbKfLteF3nLrB9z3nIaF9bHS9vM:efqK4C4BoN36t4QviFC8EBnefWl9zYaL
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:36811
svhost.exe
-
reg_key
svhost.exe
-
splitter
|Ghost|
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
New Client.exesvhost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation New Client.exe Key value queried \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\Control Panel\International\Geo\Nation svhost.exe -
Executes dropped EXE 3 IoCs
Processes:
svhost.exesvhost.exesvhost.exepid process 1480 svhost.exe 424 svhost.exe 1256 svhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3495501434-311648039-2993076821-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .." svhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svhost.exe\" .." svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exechoice.exeschtasks.exesvhost.exesvhost.exeshutdown.exeNew Client.exesvhost.exetaskkill.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3952 taskkill.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "22" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
svhost.exeshutdown.exedescription pid process Token: SeDebugPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: 33 1480 svhost.exe Token: SeIncBasePriorityPrivilege 1480 svhost.exe Token: SeShutdownPrivilege 4416 shutdown.exe Token: SeRemoteShutdownPrivilege 4416 shutdown.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
New Client.execmd.exesvhost.exedescription pid process target process PID 3104 wrote to memory of 1480 3104 New Client.exe svhost.exe PID 3104 wrote to memory of 1480 3104 New Client.exe svhost.exe PID 3104 wrote to memory of 1480 3104 New Client.exe svhost.exe PID 3104 wrote to memory of 1984 3104 New Client.exe cmd.exe PID 3104 wrote to memory of 1984 3104 New Client.exe cmd.exe PID 3104 wrote to memory of 1984 3104 New Client.exe cmd.exe PID 1984 wrote to memory of 3244 1984 cmd.exe choice.exe PID 1984 wrote to memory of 3244 1984 cmd.exe choice.exe PID 1984 wrote to memory of 3244 1984 cmd.exe choice.exe PID 1480 wrote to memory of 3952 1480 svhost.exe taskkill.exe PID 1480 wrote to memory of 3952 1480 svhost.exe taskkill.exe PID 1480 wrote to memory of 3952 1480 svhost.exe taskkill.exe PID 1480 wrote to memory of 2840 1480 svhost.exe schtasks.exe PID 1480 wrote to memory of 2840 1480 svhost.exe schtasks.exe PID 1480 wrote to memory of 2840 1480 svhost.exe schtasks.exe PID 1480 wrote to memory of 4644 1480 svhost.exe schtasks.exe PID 1480 wrote to memory of 4644 1480 svhost.exe schtasks.exe PID 1480 wrote to memory of 4644 1480 svhost.exe schtasks.exe PID 1480 wrote to memory of 4416 1480 svhost.exe shutdown.exe PID 1480 wrote to memory of 4416 1480 svhost.exe shutdown.exe PID 1480 wrote to memory of 4416 1480 svhost.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f im Wireshark.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3952 -
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f3⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\svhost.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4644 -
C:\Windows\SysWOW64\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 003⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:3244
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:424
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a11055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
PID:2908
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418B
MD55d4a9519354aeb1aa1dc3623e8eba141
SHA140dc75a5da413db2c24f0b71e3268b1b092d58b4
SHA2566af753e859a4e27e635cc7952c5c3905f09f01f488c4559736efe3a62946767b
SHA51266cbb607b1a1c4ad07c82d3769456b79dc03bac5ba46e3528ab36855d4e67fe15c89960579910b55c567270bb0e7612df311f15283884e9d3315f3bbda7c0681
-
Filesize
65KB
MD5418617925234cf8529050924c905963c
SHA1d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91
SHA2566db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8
SHA512e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415