Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 04:41
Behavioral task
behavioral1
Sample
22c54abbde95e1f240a8a65343e6faa9.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
22c54abbde95e1f240a8a65343e6faa9.exe
Resource
win10v2004-20241007-en
General
-
Target
22c54abbde95e1f240a8a65343e6faa9.exe
-
Size
31KB
-
MD5
22c54abbde95e1f240a8a65343e6faa9
-
SHA1
8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a
-
SHA256
ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc
-
SHA512
86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171
-
SSDEEP
768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj
Malware Config
Extracted
njrat
0.7d
MPG
49.228.131.165:2422
fa6b40864b6c109adbc85023cd1f59d2
-
reg_key
fa6b40864b6c109adbc85023cd1f59d2
-
splitter
Y262SUCZ4UJJ
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2376 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22c54abbde95e1f240a8a65343e6faa9.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: 33 2096 22c54abbde95e1f240a8a65343e6faa9.exe Token: SeIncBasePriorityPrivilege 2096 22c54abbde95e1f240a8a65343e6faa9.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2376 2096 22c54abbde95e1f240a8a65343e6faa9.exe 31 PID 2096 wrote to memory of 2376 2096 22c54abbde95e1f240a8a65343e6faa9.exe 31 PID 2096 wrote to memory of 2376 2096 22c54abbde95e1f240a8a65343e6faa9.exe 31 PID 2096 wrote to memory of 2376 2096 22c54abbde95e1f240a8a65343e6faa9.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\22c54abbde95e1f240a8a65343e6faa9.exe"C:\Users\Admin\AppData\Local\Temp\22c54abbde95e1f240a8a65343e6faa9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\22c54abbde95e1f240a8a65343e6faa9.exe" "22c54abbde95e1f240a8a65343e6faa9.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2376
-