Overview

overview

10

Static

static

10

22c54abbde...a9.exe

windows7-x64

10

22c54abbde...a9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-11-2024 04:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    22c54abbde95e1f240a8a65343e6faa9.exe

  • Size

    31KB

  • MD5

    22c54abbde95e1f240a8a65343e6faa9

  • SHA1

    8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a

  • SHA256

    ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc

  • SHA512

    86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171

  • SSDEEP

    768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj

Score
10/10
njratxwormmpgdiscoveryevasionpersistenceprivilege_escalationrattrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MPG

C2

49.228.131.165:2422

Mutex

fa6b40864b6c109adbc85023cd1f59d2

Attributes
  • reg_key

    fa6b40864b6c109adbc85023cd1f59d2

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

xworm

Version

5.0

C2

103.253.73.222:400

Mutex

G9FXseUZVOZM4y9H

Attributes
  • Install_directory

    %AppData%

  • install_file

    dlIlhost.exe

aes.plain

Signatures

  • Detect Xworm Payload 4 IoCs
  • Njrat family
    njrat
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\22c54abbde95e1f240a8a65343e6faa9.exe
    "C:\Users\Admin\AppData\Local\Temp\22c54abbde95e1f240a8a65343e6faa9.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\22c54abbde95e1f240a8a65343e6faa9.exe" "22c54abbde95e1f240a8a65343e6faa9.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2312
    • C:\Users\Admin\AppData\Local\Temp\tmp5AFC.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp5AFC.tmp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "dlIlhost" /tr "C:\Users\Admin\AppData\Roaming\dlIlhost.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2660
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {8AF26FFE-BFEC-41F1-9831-BDDC33B5F76B} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Roaming\dlIlhost.exe
      C:\Users\Admin\AppData\Roaming\dlIlhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2320
    • C:\Users\Admin\AppData\Roaming\dlIlhost.exe
      C:\Users\Admin\AppData\Roaming\dlIlhost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp5AFC.tmp.exe
    Filesize

    37KB

    MD5

    84d0b308ab09eb9e65c2f4f6ea622736

    SHA1

    4a855c06bdcd6c893510ca13307c727ea0c60096

    SHA256

    acdcd7790360d048ddebcddba627c81547379505c97ebb8f6e9a989149e94796

    SHA512

    f4f8c324306ac561f8b02772390e9781e3c2112d25be7c580b6269780bb1ff070726060df2a62f455141a0a37bd9a4ab7017692aecdab11c5e288f42af727867

    Download Submit

  • memory/2204-0-0x00000000748FE000-0x00000000748FF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2204-1-0x0000000000350000-0x000000000035E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2204-2-0x00000000748F0000-0x0000000074FDE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2204-3-0x00000000748FE000-0x00000000748FF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2204-4-0x00000000748F0000-0x0000000074FDE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2320-16-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2656-11-0x0000000000F60000-0x0000000000F70000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2952-18-0x00000000013A0000-0x00000000013B0000-memory.dmp

    Filesize

    64KB

    Download