Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2024 14:21
Static task
static1
Behavioral task
behavioral1
Sample
3dbe30b615ca39afbc28c4e00fb5941d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3dbe30b615ca39afbc28c4e00fb5941d.exe
Resource
win10v2004-20241007-en
General
-
Target
3dbe30b615ca39afbc28c4e00fb5941d.exe
-
Size
489KB
-
MD5
3dbe30b615ca39afbc28c4e00fb5941d
-
SHA1
199f664cf6d92a172c2e2d8cbfcd71f2884f2906
-
SHA256
66a1743f5791c9746a988bb1e5c250f25941a3122430be24380d9a9cb3484961
-
SHA512
2fd60508dfbe0942363bdd1183df0e2c43d628af036462d9ab648bce15209ef39061e64b162174b500fb5c79a3dcb07a6098bb365c9eea76dcd4fb0ab62110e8
-
SSDEEP
12288:tar1ua/gY5dCTiJ5njy4NR/9M4OZp75vl07sOxc:ohn5QyNykI4AVly7
Malware Config
Extracted
njrat
0.7d
VIP@DUMP
volkatv500.sytes.net:999
e0bb29bc288c4cac846ed6aff410e0c6
-
reg_key
e0bb29bc288c4cac846ed6aff410e0c6
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2376 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 3dbe30b615ca39afbc28c4e00fb5941d.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e0bb29bc288c4cac846ed6aff410e0c6.exe winhelp.bat File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e0bb29bc288c4cac846ed6aff410e0c6.exe winhelp.bat -
Executes dropped EXE 1 IoCs
pid Process 2852 winhelp.bat -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e0bb29bc288c4cac846ed6aff410e0c6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\winhelp.bat\" .." winhelp.bat Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e0bb29bc288c4cac846ed6aff410e0c6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\winhelp.bat\" .." winhelp.bat -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat Token: 33 2852 winhelp.bat Token: SeIncBasePriorityPrivilege 2852 winhelp.bat -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2852 1308 3dbe30b615ca39afbc28c4e00fb5941d.exe 96 PID 1308 wrote to memory of 2852 1308 3dbe30b615ca39afbc28c4e00fb5941d.exe 96 PID 2852 wrote to memory of 2376 2852 winhelp.bat 98 PID 2852 wrote to memory of 2376 2852 winhelp.bat 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dbe30b615ca39afbc28c4e00fb5941d.exe"C:\Users\Admin\AppData\Local\Temp\3dbe30b615ca39afbc28c4e00fb5941d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Roaming\winhelp.bat"C:\Users\Admin\AppData\Roaming\winhelp.bat"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\winhelp.bat" "winhelp.bat" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2376
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
489KB
MD53dbe30b615ca39afbc28c4e00fb5941d
SHA1199f664cf6d92a172c2e2d8cbfcd71f2884f2906
SHA25666a1743f5791c9746a988bb1e5c250f25941a3122430be24380d9a9cb3484961
SHA5122fd60508dfbe0942363bdd1183df0e2c43d628af036462d9ab648bce15209ef39061e64b162174b500fb5c79a3dcb07a6098bb365c9eea76dcd4fb0ab62110e8