Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
05-01-2025 08:01
Behavioral task
behavioral1
Sample
Server.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
16 signatures
300 seconds
Errors
Reason
Machine shutdown
General
-
Target
Server.exe
-
Size
43KB
-
MD5
6dd93ac4471a3c615061219b4cd54da3
-
SHA1
c71064ca536f0cbc633c4e0159b0e72b428ae03a
-
SHA256
74c40e2f13f3919815e98e4c5b6b1a6a34cd3d0f97ca588d56b4a1ae90979342
-
SHA512
4b04187edfd322606b34d61234ab13e836cd063bffcf09b694a1754857f8d14c39673b5660d7097da0a269bc1c54872b67552cf47cc695ca2f21c88d65eefa1f
-
SSDEEP
384:QZyJj+CdsbhKIyKRBxwOIEWrr2z8Iij+ZsNO3PlpJKkkjh/TzF7pWnf/greT0pqP:W2NiwFKDx3ukuXQ/oS/+L
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
run-julie.gl.at.ply.gg:5550
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Njrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\Control Panel\International\Geo\Nation Server.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe Dllhost.exe -
Executes dropped EXE 3 IoCs
pid Process 1932 Dllhost.exe 3452 Server.exe 1180 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4084745894-3294430273-2212167662-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .." Dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dllhost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1672 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 3808 Server.exe 1932 Dllhost.exe 1928 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 1928 taskmgr.exe Token: SeSystemProfilePrivilege 1928 taskmgr.exe Token: SeCreateGlobalPrivilege 1928 taskmgr.exe Token: SeDebugPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe Token: 33 1932 Dllhost.exe Token: SeIncBasePriorityPrivilege 1932 Dllhost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3808 wrote to memory of 1932 3808 Server.exe 88 PID 3808 wrote to memory of 1932 3808 Server.exe 88 PID 3808 wrote to memory of 1932 3808 Server.exe 88 PID 1932 wrote to memory of 1672 1932 Dllhost.exe 92 PID 1932 wrote to memory of 1672 1932 Dllhost.exe 92 PID 1932 wrote to memory of 1672 1932 Dllhost.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1672
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1928
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp/Server.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3452
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp/Server.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
507B
MD5dd113bc063fe53dc74ead8403c979e3d
SHA1f0a5283a5d047aeb6b4b906194e5f3252b95d5e9
SHA256aebf3315c2c092e5b9bf62717e6e8ec7a8c48433a531162e35e3f1a6bde4b242
SHA512c951f5740dcfa018d92a78bcaabee5a39079beeb72041975f85ee2b01bd25e507fb9a2a2d8962196e04edf00cbe69eb235b0117056dd95476093577e537e2281
-
Filesize
43KB
MD56dd93ac4471a3c615061219b4cd54da3
SHA1c71064ca536f0cbc633c4e0159b0e72b428ae03a
SHA25674c40e2f13f3919815e98e4c5b6b1a6a34cd3d0f97ca588d56b4a1ae90979342
SHA5124b04187edfd322606b34d61234ab13e836cd063bffcf09b694a1754857f8d14c39673b5660d7097da0a269bc1c54872b67552cf47cc695ca2f21c88d65eefa1f
-
Filesize
86KB
MD5c7bab02e8d39c779ccba1d1fed3b28e2
SHA10628b530e18507812ed24e12665b9601b31118d6
SHA256cbaf648d10ddd488199570e45e27bf23c43bfb1280e1f3b2936cbcf634e75616
SHA51288c37a5d0d2838be0cafc052d0f34b32ae57534b6525c666544bba98b978bd2fb1ed52443e6401b0771d0b91c6e882c96b8d75251ad5e0764c2aa64d757ad3b2