Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 07:13

General

  • Target

    17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42.exe

  • Size

    8.7MB

  • MD5

    cb7483706f5b088ee99cac7f310479d3

  • SHA1

    3c956516383d5a20966ee65d270f75a941ec9416

  • SHA256

    17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42

  • SHA512

    c4dc3ac9461d54c0f4d893a2fb457edbb6a60d77c0cb99717e655119e459e81ce70c097d90a2ab33f5d19fe5607fbf107974d4e82569950b682bcf74b9ece74d

  • SSDEEP

    196608:hCbGPZmVfjsCbGPZmVfjiCbGPZmVfjsCbGPZmVfj2CbGPZmVfjsCbGPZmVfjiCbE:0GmVNGmVrGmVNGmVnGmVNGmVrGmVNGmo

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

jjj

C2

youri.mooo.com:1605

Mutex

e936a10f968ac948cd351c9629dbd36d

Attributes
  • reg_key

    e936a10f968ac948cd351c9629dbd36d

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • NTFS ADS 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42.exe
    "C:\Users\Admin\AppData\Local\Temp\17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42.exe"
    1⤵
    • Adds Run key to start application
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start C:\PROGRA~3\17203C~1.TXT
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Windows\SysWOW64\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\PROGRA~3\17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42.exe.txt
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4680
    • C:\ProgramData\winmgr107.exe
      C:\ProgramData\winmgr107.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3152
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        0
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2360
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2284
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3848
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3520
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1188
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2468
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4664
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3908
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2128
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:8
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2700
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3768
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:916
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4748
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2152
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2160
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:4988
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:456
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5108
      • C:\Windows\SysWOW64\schtasks.exe
        C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr107.exe" /tr "C:\ProgramData\winmgr107.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1536
  • C:\ProgramData\winmgr107.exe
    C:\ProgramData\winmgr107.exe
    1⤵
    • Executes dropped EXE
    • Subvert Trust Controls: Mark-of-the-Web Bypass
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    PID:3872
  • C:\ProgramData\winmgr107.exe
    C:\ProgramData\winmgr107.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2600

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    180.129.81.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.129.81.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
  • flag-us
    DNS
    youri.mooo.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    youri.mooo.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    180.129.81.91.in-addr.arpa
    dns
    72 B
    147 B
    1
    1

    DNS Request

    180.129.81.91.in-addr.arpa

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    120 B
    119 B
    2
    1

    DNS Request

    youri.mooo.com

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

  • 8.8.8.8:53
    youri.mooo.com
    dns
    RegAsm.exe
    60 B
    119 B
    1
    1

    DNS Request

    youri.mooo.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42.exe.txt

    Filesize

    992B

    MD5

    c8cf7247d4cfc99a7582a42d13df4c08

    SHA1

    317f5588af0b3b6374c436fb00084c522fd78a83

    SHA256

    78bd99781e971622f1573bccf2ae9cdd7a7498cf81c1875afc65913e1083b1d0

    SHA512

    5dd86b7ba388e5d2ad61b1c69589f42c36eec23a04b3cece0941133e0cf0e8a6f1f3aa2242d87af72db725b4b96032dadae72b3be98af3cfce5786ad8c08c357

  • C:\ProgramData\winmgr107.exe

    Filesize

    8.7MB

    MD5

    79a45de350b02eb2418c628d42b8e7ed

    SHA1

    fa57fd6326cdb5085a44a799a317edd12a414c92

    SHA256

    4f6c10a7dbc8f1a88bcc37418ec3da75df4de3e96a6401236ca9588f971ca733

    SHA512

    0d30b50f409b6d8b54985d8d71ff60ff368e70eed72c6ede5a2132b686f9b05157003663d05b53db16a6c9596aba155835e4d3154440849ccbafda10f6546f5d

  • C:\Users\Admin\AppData\Local\Temp\17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42.exe

    Filesize

    8.7MB

    MD5

    cb7483706f5b088ee99cac7f310479d3

    SHA1

    3c956516383d5a20966ee65d270f75a941ec9416

    SHA256

    17203c2e1d65d1ba026bf3ed1932e3fff2a6c524f460602aa3571e14a25ecd42

    SHA512

    c4dc3ac9461d54c0f4d893a2fb457edbb6a60d77c0cb99717e655119e459e81ce70c097d90a2ab33f5d19fe5607fbf107974d4e82569950b682bcf74b9ece74d

  • memory/2520-15-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

    Filesize

    48KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.