Overview
overview
10Static
static
1015a83de318...fa.exe
windows7-x64
615a83de318...fa.exe
windows10-2004-x64
6304f9bc7de...1b.exe
windows7-x64
10304f9bc7de...1b.exe
windows10-2004-x64
1043087ea949...eb.exe
windows7-x64
1043087ea949...eb.exe
windows10-2004-x64
1061bb2c746d...fd.exe
windows7-x64
1061bb2c746d...fd.exe
windows10-2004-x64
1078ae7a93d9...b6.exe
windows7-x64
1078ae7a93d9...b6.exe
windows10-2004-x64
10878487e25e...53.exe
windows7-x64
10878487e25e...53.exe
windows10-2004-x64
10922135a10e...54.exe
windows7-x64
10922135a10e...54.exe
windows10-2004-x64
1098e12d1098...ad.exe
windows7-x64
1098e12d1098...ad.exe
windows10-2004-x64
10b67bc3d957...8f.exe
windows7-x64
8b67bc3d957...8f.exe
windows10-2004-x64
8Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 16:29
Behavioral task
behavioral1
Sample
15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
15a83de3182943e692fd43702b5b580a77d5c52a3097bac79257d9e168b0c0fa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
304f9bc7de67c32d895d2a005283ae4b7a63e390915463ca0a9aa404a9e29e1b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
43087ea9490bfbbc1216d8e9aeece07cf0125fd8bfbcaf8ff726c93adc7bd4eb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
78ae7a93d9e328b6e2c05b730df6384b3da3afe8674be983c19116d1457da7b6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
878487e25eb96ab2c4ebd889e4bfc1739d730722c2af4736bc46ac3d11eca453.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
922135a10e85dde50c701490c1b71fa8c686becb0c8bbf020e64cd3b36927754.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
98e12d1098dae7e51260059a00b98ea0f197fd7b262e14693579cc8ba45e1fad.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
b67bc3d9578e037d7cf91795a1015008d2ee5629c5b8089a16ae3d3bac92168f.exe
Resource
win10v2004-20241007-en
General
-
Target
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe
-
Size
1.4MB
-
MD5
c58f3effb9efb892109332a676aae546
-
SHA1
c1dced7e3e3b49f23cc0125589cc5b29d4055924
-
SHA256
61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd
-
SHA512
9c9329df603ad34b10437fc6313d61d273b603996a82f88e0d57af9e50ea86bb0cbb2134a3d4905b40fd73cd40222235739f4140cf4de19a3bea352af947adec
-
SSDEEP
24576:a27mrhic6gvYbAKsy5Ulh3iXWl9557sK6X3ZO0GinMSvTNWfshnGmg/ykTPnewlm:anrhr/vAcWKv6X3o0GQN0s/g/ybDT
Malware Config
Extracted
njrat
0.7d
HacKed
8.tcp.ngrok.io:12342
602fdca88735a1a1338352d8ae49ef80
-
reg_key
602fdca88735a1a1338352d8ae49ef80
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2068 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 2896 XTdl5rknHl.exe 2776 server.exe -
Loads dropped DLL 2 IoCs
pid Process 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 2896 XTdl5rknHl.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\602fdca88735a1a1338352d8ae49ef80 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\602fdca88735a1a1338352d8ae49ef80 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 22 8.tcp.ngrok.io 41 8.tcp.ngrok.io 5 8.tcp.ngrok.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2944 2312 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XTdl5rknHl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe Token: SeDebugPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe Token: 33 2776 server.exe Token: SeIncBasePriorityPrivilege 2776 server.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2896 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 30 PID 2312 wrote to memory of 2896 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 30 PID 2312 wrote to memory of 2896 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 30 PID 2312 wrote to memory of 2896 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 30 PID 2312 wrote to memory of 2944 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 31 PID 2312 wrote to memory of 2944 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 31 PID 2312 wrote to memory of 2944 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 31 PID 2312 wrote to memory of 2944 2312 61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe 31 PID 2896 wrote to memory of 2776 2896 XTdl5rknHl.exe 32 PID 2896 wrote to memory of 2776 2896 XTdl5rknHl.exe 32 PID 2896 wrote to memory of 2776 2896 XTdl5rknHl.exe 32 PID 2896 wrote to memory of 2776 2896 XTdl5rknHl.exe 32 PID 2776 wrote to memory of 2068 2776 server.exe 33 PID 2776 wrote to memory of 2068 2776 server.exe 33 PID 2776 wrote to memory of 2068 2776 server.exe 33 PID 2776 wrote to memory of 2068 2776 server.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe"C:\Users\Admin\AppData\Local\Temp\61bb2c746d218b86b3b9e069899e4ec1bf16a61206e66bfda7badf06915456fd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe"C:\Users\Admin\AppData\Local\Temp\XTdl5rknHl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2068
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 13042⤵
- Program crash
PID:2944
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD5059302e210a714b3cebd8c6400d7d12e
SHA1eed4e297cdffff9815bf456e4f237b699b33de6d
SHA2567b49bca136184f784b52ca6499108288da623944a0a97eff19e3318364a0a999
SHA5125ae9f86dc384be6d7acb085132846ef690d0e069f43837e8e9edb89558bfb8c3a5232e47332df10b79ee8df2e4e84c509386c5fbb9f8b5a7659ff8cacb1a4dcc