Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 16:52
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win10v2004-20241007-en
General
-
Target
Payload.exe
-
Size
55KB
-
MD5
5c56be92df69c8add408d506c5532239
-
SHA1
0dad011e6ddbd559d30217bf8b9da634a72c2023
-
SHA256
b58ab675e6430d8d9eeb6d316a635f5eb62fb19cd1120b3d1376136df5c8a44e
-
SHA512
85ebfc2be987a011bb4db28842a90a7be26560ee843600f0b39b0805980ba27cc00db7cd635305dfdeecb6333576c6ba501fe0f79d56f0cbe8eaa12ecc3560cf
-
SSDEEP
1536:qPsoDnb4DNQ7SCCHDrwsNMDxXExI3pm9m:noDnEWOrHDrwsNMDxXExI3pm
Malware Config
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Payload.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4c4f4a71cf4fc204c1ef58ead9ffcdec.exe dllhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4c4f4a71cf4fc204c1ef58ead9ffcdec.exe dllhost.exe -
Executes dropped EXE 1 IoCs
pid Process 4292 dllhost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4c4f4a71cf4fc204c1ef58ead9ffcdec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4c4f4a71cf4fc204c1ef58ead9ffcdec = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe Token: 33 4292 dllhost.exe Token: SeIncBasePriorityPrivilege 4292 dllhost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2036 wrote to memory of 4292 2036 Payload.exe 83 PID 2036 wrote to memory of 4292 2036 Payload.exe 83 PID 2036 wrote to memory of 4292 2036 Payload.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD55c56be92df69c8add408d506c5532239
SHA10dad011e6ddbd559d30217bf8b9da634a72c2023
SHA256b58ab675e6430d8d9eeb6d316a635f5eb62fb19cd1120b3d1376136df5c8a44e
SHA51285ebfc2be987a011bb4db28842a90a7be26560ee843600f0b39b0805980ba27cc00db7cd635305dfdeecb6333576c6ba501fe0f79d56f0cbe8eaa12ecc3560cf