Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 10:36
Static task
static1
Behavioral task
behavioral1
Sample
f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe
Resource
win10v2004-20241007-en
General
-
Target
f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe
-
Size
94KB
-
MD5
2086ab4be1e7ec95fa9ccf40895986e0
-
SHA1
3d877603fbdb832bc59af3700547e27d7a34f9f3
-
SHA256
f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953
-
SHA512
88b9730600ed98466e620537aa0f04eed23bcf8f4b7b6bb55eafaea68d727bfdc23e62a780b636078f9c5223eb85a0d21bfb2ec78742d71ad9a8105e4a507a9a
-
SSDEEP
1536:ToCHfmQnPG8baRYX2Nb5sVo/wgTedTK+ueIS5bhUjnPWyJhDNWcb5t4U9tj8MYuS:ToktPG8baRYX2N9HTA3YVhD55/tQG
Malware Config
Extracted
njrat
0.7d
HacKed
jh34j4h34h.ddns.net:1177
4a8f2ff0614688c198a022511337d8fb
-
reg_key
4a8f2ff0614688c198a022511337d8fb
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3888 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe -
Executes dropped EXE 1 IoCs
pid Process 3096 server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4a8f2ff0614688c198a022511337d8fb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4a8f2ff0614688c198a022511337d8fb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe Token: 33 3096 server.exe Token: SeIncBasePriorityPrivilege 3096 server.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4352 wrote to memory of 3096 4352 f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe 90 PID 4352 wrote to memory of 3096 4352 f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe 90 PID 4352 wrote to memory of 3096 4352 f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe 90 PID 3096 wrote to memory of 3888 3096 server.exe 100 PID 3096 wrote to memory of 3888 3096 server.exe 100 PID 3096 wrote to memory of 3888 3096 server.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe"C:\Users\Admin\AppData\Local\Temp\f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3888
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4352 -ip 43521⤵PID:2740
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD52086ab4be1e7ec95fa9ccf40895986e0
SHA13d877603fbdb832bc59af3700547e27d7a34f9f3
SHA256f782b67a7c1d4504d282bbabca3bfff4dcb14b989225695b8a80e0aedc3a9953
SHA51288b9730600ed98466e620537aa0f04eed23bcf8f4b7b6bb55eafaea68d727bfdc23e62a780b636078f9c5223eb85a0d21bfb2ec78742d71ad9a8105e4a507a9a