Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe
Resource
win10v2004-20241007-en
General
-
Target
f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe
-
Size
432KB
-
MD5
57a9c69d63266d547a59f374abe187ea
-
SHA1
c3f628d6fa93a1c89c1adb7e9ca9c913395de44a
-
SHA256
f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b
-
SHA512
d971f3f0a1c9e003d3c32b937a84cf9f0f8b50df0946b4c342df5682f009a5bffab318e3edb66f5e0bb2fd0436f9d0fb88b0813206007c04c63b8ddc3c7fb943
-
SSDEEP
96:fsDYb94x6pIEYaXcwhx5zWLYxT9FS7Z0epAIb+zNtp:UEb94x8pYapz1WLOxU7Z0dcYv
Malware Config
Extracted
njrat
0.7d
2021
aqq.linkpc.net:999
a1776750d898d3976ceabc94432acfb1
-
reg_key
a1776750d898d3976ceabc94432acfb1
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2696 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 2052 System64.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\a1776750d898d3976ceabc94432acfb1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System64.exe\" .." System64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\a1776750d898d3976ceabc94432acfb1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\System64.exe\" .." System64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe Token: 33 2052 System64.exe Token: SeIncBasePriorityPrivilege 2052 System64.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2052 2736 f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe 30 PID 2736 wrote to memory of 2052 2736 f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe 30 PID 2736 wrote to memory of 2052 2736 f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe 30 PID 2052 wrote to memory of 2696 2052 System64.exe 31 PID 2052 wrote to memory of 2696 2052 System64.exe 31 PID 2052 wrote to memory of 2696 2052 System64.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe"C:\Users\Admin\AppData\Local\Temp\f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Roaming\System64.exe"C:\Users\Admin\AppData\Roaming\System64.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\System64.exe" "System64.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2696
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD557a9c69d63266d547a59f374abe187ea
SHA1c3f628d6fa93a1c89c1adb7e9ca9c913395de44a
SHA256f747150ab61965f0a0d5bfca6c190795733eb46671a3dd500073f51c2457075b
SHA512d971f3f0a1c9e003d3c32b937a84cf9f0f8b50df0946b4c342df5682f009a5bffab318e3edb66f5e0bb2fd0436f9d0fb88b0813206007c04c63b8ddc3c7fb943