Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 00:40
Behavioral task
behavioral1
Sample
861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe
Resource
win10v2004-20241007-en
General
-
Target
861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe
-
Size
93KB
-
MD5
ccb06fa4b339cc8ff5ae2331dda084b4
-
SHA1
0d1af1ebe0cb29ebf9ea4c76a7630661553b64db
-
SHA256
861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953
-
SHA512
a716f4906ac8ba1135471deef804e886891cfdc7b3f8b8d471a8fec0aadb0a39051b5adb3930c6a715b2c7a6a46168bacb6ef9705925bfd02fd88b4ebc335952
-
SSDEEP
1536:InwEnYi9bzKuZ+8uZ3nV5XS65mkrPZ58kzQ+e+e+:IwaYi9bsh7J7M+e+e+
Malware Config
Extracted
njrat
v4.0
Steam
40.80.147.203:8080
Steam
-
reg_key
Steam
-
splitter
|-F-|
Signatures
-
Njrat family
-
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk Steam.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.exe Steam.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.exe Steam.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.exe attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2284 Steam.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Steam.URL" Steam.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam2 = "C:\\Windows\\Steam.exe" 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Steam.URL" Steam.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Steam2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Steam.URL" Steam.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Steam.URL" Steam.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Steam.exe 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe File opened for modification C:\Windows\Steam.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Steam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe Token: 33 2284 Steam.exe Token: SeIncBasePriorityPrivilege 2284 Steam.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2284 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 30 PID 2192 wrote to memory of 2284 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 30 PID 2192 wrote to memory of 2284 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 30 PID 2192 wrote to memory of 2284 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 30 PID 2192 wrote to memory of 2692 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 31 PID 2192 wrote to memory of 2692 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 31 PID 2192 wrote to memory of 2692 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 31 PID 2192 wrote to memory of 2692 2192 861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe 31 PID 2284 wrote to memory of 3012 2284 Steam.exe 33 PID 2284 wrote to memory of 3012 2284 Steam.exe 33 PID 2284 wrote to memory of 3012 2284 Steam.exe 33 PID 2284 wrote to memory of 3012 2284 Steam.exe 33 PID 2284 wrote to memory of 2636 2284 Steam.exe 34 PID 2284 wrote to memory of 2636 2284 Steam.exe 34 PID 2284 wrote to memory of 2636 2284 Steam.exe 34 PID 2284 wrote to memory of 2636 2284 Steam.exe 34 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 2692 attrib.exe 3012 attrib.exe 2636 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe"C:\Users\Admin\AppData\Local\Temp\861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\Steam.exe"C:\Windows\Steam.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.exe"3⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3012
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Steam.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2636
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Windows\Steam.exe"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56a3a5abf95afd78bb71ec644e7a7d9a8
SHA18e12c3edcb834d4b1b268f99df871a838e3fe787
SHA256bf5e9d8df74a978786ae18c57ba64d7a87cde91d15396cd0c62ee470259645c8
SHA512f7df2eec5b5a75110270ae634826219febf775aba776c5289b7c375e5d6b233c631750a5f69d0fc0fc3973b16f9a11e6b97028cecfbdeb3a535b0c3b3a664974
-
Filesize
1012B
MD5a164fb3908c0529a02916875f6e5ab75
SHA14f792500be2613caf27501275683ca65a027061a
SHA25639b5b71b35302228e7cfddfceda08e680896f484f9c9d39d7a6dbbd1837f97ba
SHA51284d95a10b621d10391252e544402ae1215852bb018705e0f0d06b79273d05d30cc2a9d3b4a2acafb6152d9d3d3a9a1baf50e74af3bc1ab98217bc2b473b0debe
-
Filesize
93KB
MD5ccb06fa4b339cc8ff5ae2331dda084b4
SHA10d1af1ebe0cb29ebf9ea4c76a7630661553b64db
SHA256861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953
SHA512a716f4906ac8ba1135471deef804e886891cfdc7b3f8b8d471a8fec0aadb0a39051b5adb3930c6a715b2c7a6a46168bacb6ef9705925bfd02fd88b4ebc335952