Analysis
-
max time kernel
65s -
max time network
64s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
05-01-2025 07:55
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
Behavioral task
behavioral2
Sample
Server.exe
Resource
win11-20241007-en
windows11-21h2-x64
Errors
General
-
Target
Server.exe
-
Size
43KB
-
MD5
3b426fddedbb6f2ba8debc7eefe1ffb0
-
SHA1
8e69d401eb75f78de701954d595156826d324a7e
-
SHA256
17d0bef5296fdef3bca0bee36e09baf19e258c6290f41849c3a92132d0cf54d3
-
SHA512
2edb6201132390d985f4e1c1f476cb0de02dba05d826f2087c77b8f577a84ad59a787f46c0a40a01f10a8073cda052e5d9071474248c71cb8bc75358a323d8d4
-
SSDEEP
384:YZyJj+CdsbhKIyKRBxwOIEWrr2z8Iij+ZsNO3PlpJKkkjh/TzF7pWnvW/greT0pu:u2NiwFKDx3ukuXQ/oCW/+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
run-julie.gl.at.ply.gg:56057
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Server.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 2 IoCs
pid Process 1660 Dllhost.exe 4720 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3080 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3844 Server.exe 1660 Dllhost.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 2696 taskmgr.exe Token: SeSystemProfilePrivilege 2696 taskmgr.exe Token: SeCreateGlobalPrivilege 2696 taskmgr.exe Token: SeDebugPrivilege 1660 Dllhost.exe Token: 33 1660 Dllhost.exe Token: SeIncBasePriorityPrivilege 1660 Dllhost.exe Token: 33 1660 Dllhost.exe Token: SeIncBasePriorityPrivilege 1660 Dllhost.exe Token: 33 1660 Dllhost.exe Token: SeIncBasePriorityPrivilege 1660 Dllhost.exe Token: 33 1660 Dllhost.exe Token: SeIncBasePriorityPrivilege 1660 Dllhost.exe Token: 33 1660 Dllhost.exe Token: SeIncBasePriorityPrivilege 1660 Dllhost.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3844 wrote to memory of 1660 3844 Server.exe 89 PID 3844 wrote to memory of 1660 3844 Server.exe 89 PID 3844 wrote to memory of 1660 3844 Server.exe 89 PID 1660 wrote to memory of 3080 1660 Dllhost.exe 93 PID 1660 wrote to memory of 3080 1660 Dllhost.exe 93 PID 1660 wrote to memory of 3080 1660 Dllhost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3080
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp/Server.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4720
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD5dd113bc063fe53dc74ead8403c979e3d
SHA1f0a5283a5d047aeb6b4b906194e5f3252b95d5e9
SHA256aebf3315c2c092e5b9bf62717e6e8ec7a8c48433a531162e35e3f1a6bde4b242
SHA512c951f5740dcfa018d92a78bcaabee5a39079beeb72041975f85ee2b01bd25e507fb9a2a2d8962196e04edf00cbe69eb235b0117056dd95476093577e537e2281
-
Filesize
43KB
MD53b426fddedbb6f2ba8debc7eefe1ffb0
SHA18e69d401eb75f78de701954d595156826d324a7e
SHA25617d0bef5296fdef3bca0bee36e09baf19e258c6290f41849c3a92132d0cf54d3
SHA5122edb6201132390d985f4e1c1f476cb0de02dba05d826f2087c77b8f577a84ad59a787f46c0a40a01f10a8073cda052e5d9071474248c71cb8bc75358a323d8d4
-
Filesize
86KB
MD5851ce219d1da80d4bf9d0b6827d99437
SHA17802f028715c0972ea314730a7b0cd8b59cf088f
SHA25645740931b853d9e8531093ec293fe0e69521610684359aa21637097efe00f9b0
SHA5129b1433617d3cc3e318baed2aa8cb0d6182325f3749f93440b8f89f033b62ae14ed745d11142520b3737324885133cd056bf1f098c80b9d8a65ce77b7f14e2a78