Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 19:41 UTC

General

  • Target

    e9730571a15989a660d7ce526719b3fe4df1cc8226993035522e8fb98d4bcc8e.exe

  • Size

    1.2MB

  • MD5

    37940b39a24ea6db8d907a54fdc6faf2

  • SHA1

    eea6075183c9852003006d2565ca02e95e7180f3

  • SHA256

    e9730571a15989a660d7ce526719b3fe4df1cc8226993035522e8fb98d4bcc8e

  • SHA512

    afe49b153806297bcc86ddd205d4cc22e57b743a0b62f486a259bd8e9792cc8cdf68d7347c5895967c598471efc1372b128714865235bb34940fa626b835f301

  • SSDEEP

    24576:eAHnh+eWsN3skA4RV1Hom2KXMmHaW7aWvCaFg5a7PCmWX95L:Jh+ZkldoPK8YaW7CaZ7IHL

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

redlanhopto

C2

redlan.hopto.org:5553

Mutex

d25d360449d7bab3069e1b77b3a914a3

Attributes
  • reg_key

    d25d360449d7bab3069e1b77b3a914a3

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e9730571a15989a660d7ce526719b3fe4df1cc8226993035522e8fb98d4bcc8e.exe
    "C:\Users\Admin\AppData\Local\Temp\e9730571a15989a660d7ce526719b3fe4df1cc8226993035522e8fb98d4bcc8e.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1852
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn igfxHK /tr "C:\Users\Admin\AppData\Roaming\chkdsk\data.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:208
  • C:\Users\Admin\AppData\Roaming\chkdsk\data.exe
    C:\Users\Admin\AppData\Roaming\chkdsk\data.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1832

Network

  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    redlan.hopto.org
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    redlan.hopto.org
    IN A
    Response
    redlan.hopto.org
    IN A
    184.105.237.195
  • flag-us
    DNS
    195.237.105.184.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    195.237.105.184.in-addr.arpa
    IN PTR
    Response
    195.237.105.184.in-addr.arpa
    IN CNAME
    195.192-26.237.105.184.in-addr.arpa
    195.192-26.237.105.184.in-addr.arpa
    IN PTR
    184-105-237-195sinkhole shadowserverorg
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
  • 184.105.237.195:5553
    redlan.hopto.org
    RegAsm.exe
    632 B
    248 B
    7
    6
  • 184.105.237.195:5553
    redlan.hopto.org
    RegAsm.exe
    678 B
    288 B
    8
    7
  • 184.105.237.195:5553
    redlan.hopto.org
    RegAsm.exe
    893 B
    208 B
    8
    5
  • 184.105.237.195:5553
    redlan.hopto.org
    RegAsm.exe
    540 B
    168 B
    5
    4
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    redlan.hopto.org
    dns
    RegAsm.exe
    62 B
    78 B
    1
    1

    DNS Request

    redlan.hopto.org

    DNS Response

    184.105.237.195

  • 8.8.8.8:53
    195.237.105.184.in-addr.arpa
    dns
    74 B
    154 B
    1
    1

    DNS Request

    195.237.105.184.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    140 B
    133 B
    2
    1

    DNS Request

    83.210.23.2.in-addr.arpa

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    144 B
    158 B
    2
    1

    DNS Request

    19.229.111.52.in-addr.arpa

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\chkdsk\data.exe

    Filesize

    1.2MB

    MD5

    517e825eff455ac82e9170c4f7b7dc5b

    SHA1

    b57db47304e6e4c85224b661ff21a27337556609

    SHA256

    20802d6d5062b4d055d770f129ae62dbbc5fd5e97528fbdd742fb4278caeafaf

    SHA512

    418b7f5ffe10018b06991063b607552889b48c8430ba9081c3071f01d7f776d4b5ea0983c4e827a8662625fb8b5d7c6779a317bce1c17319b84ed56c2c1b89b8

  • memory/920-0-0x0000000001630000-0x0000000001631000-memory.dmp

    Filesize

    4KB

  • memory/4988-1-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/4988-6-0x0000000074392000-0x0000000074393000-memory.dmp

    Filesize

    4KB

  • memory/4988-7-0x0000000074390000-0x0000000074941000-memory.dmp

    Filesize

    5.7MB

  • memory/4988-8-0x0000000074390000-0x0000000074941000-memory.dmp

    Filesize

    5.7MB

  • memory/4988-9-0x0000000074392000-0x0000000074393000-memory.dmp

    Filesize

    4KB

  • memory/4988-10-0x0000000074390000-0x0000000074941000-memory.dmp

    Filesize

    5.7MB

  • memory/4988-11-0x0000000074390000-0x0000000074941000-memory.dmp

    Filesize

    5.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.