Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2024, 01:06 UTC

General

  • Target

    7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e.exe

  • Size

    649KB

  • MD5

    d5cfb8356001e1ea478e2f66648f132b

  • SHA1

    5d4b419bbd52f0ac2f682b46fefffed6e7621b48

  • SHA256

    7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e

  • SHA512

    9f02f9086f3f88914b9062fa41f225b32721d528f6036ce5430ec2225a51ba2ce596c98a51a2b85fcb261c196ac42e0c2a3f8c57a6254c264ee7cd9cc4477abf

  • SSDEEP

    6144:TGxP9WE3Ow/2pVNqVotvLDkivApjJRVg+U/+vNl0MAyigSNiRU9/kXkxioatQ9U3:CxIExJiynfUerAyDQCkxjIfBWMt

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Hacker

C2

154.176.159.102:1177

Mutex

8b8934ec24fc05c5f20511aa61ac2fa9

Attributes
  • reg_key

    8b8934ec24fc05c5f20511aa61ac2fa9

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e.exe
    "C:\Users\Admin\AppData\Local\Temp\7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Roaming\Server.exe
      "C:\Users\Admin\AppData\Roaming\Server.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\system32\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Server.exe" "Server.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:2988

Network

    No results found
  • 154.176.159.102:1177
    Server.exe
    152 B
    3
  • 154.176.159.102:1177
    Server.exe
    152 B
    3
  • 154.176.159.102:1177
    Server.exe
    152 B
    3
  • 154.176.159.102:1177
    Server.exe
    52 B
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Server.exe

    Filesize

    649KB

    MD5

    d5cfb8356001e1ea478e2f66648f132b

    SHA1

    5d4b419bbd52f0ac2f682b46fefffed6e7621b48

    SHA256

    7e5cdb1f90f0fe63a1ae0ae850d61da4e56ae23d53041fd9e14002761ffb4e2e

    SHA512

    9f02f9086f3f88914b9062fa41f225b32721d528f6036ce5430ec2225a51ba2ce596c98a51a2b85fcb261c196ac42e0c2a3f8c57a6254c264ee7cd9cc4477abf

  • memory/2160-6-0x00000000008C0000-0x00000000008CE000-memory.dmp

    Filesize

    56KB

  • memory/2160-2-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2160-3-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2160-4-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2160-5-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

    Filesize

    4KB

  • memory/2160-0-0x000007FEF55BE000-0x000007FEF55BF000-memory.dmp

    Filesize

    4KB

  • memory/2160-1-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2160-14-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2580-12-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2580-13-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2580-15-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

  • memory/2580-16-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

    Filesize

    9.6MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.