Overview

overview

10

Static

static

3

Hazem pro.exe

windows10-ltsc 2021-x64

10

Hazem pro.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    210s
  • max time network
    203s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14-01-2025 10:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hazem pro.exe

  • Size

    1.3MB

  • MD5

    9d399494a5edab7861687db8301165ee

  • SHA1

    939172bd2056b077375daf57bdc3227688c0174f

  • SHA256

    21a76a566962c21072555e4bb5121349968ca8e5a4a459b8c628f50be8edb549

  • SHA512

    b4c66b06ddd3b3dd759643769b062f6f021204d7ab6e7605da9d8ba92e62664a672e2f79cbbdb0ac120bf89f30b717cb6920dfa9ca170dd7c7000c47553f916c

  • SSDEEP

    24576:Pnzkt2a4f25l9otyOiAifrtx5V3S7KS9ZIUK5HKeKYjFXXTmVGWVRDnORAQ7iE:ryW+5otyOaDtx5V3VS/hK5qleXXTmL3k

Score
10/10
njratتم الاختراق بواسطا احمد السيسي discoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

تم الاختراق بواسطا احمد السيسي

C2

maestro49.ddns.net:5552

Mutex

5f137ae7d0d66d9b5cded8a570234747

Attributes
  • reg_key

    5f137ae7d0d66d9b5cded8a570234747

  • splitter

    |'|'|

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hazem pro.exe
    "C:\Users\Admin\AppData\Local\Temp\Hazem pro.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5856
    • C:\Users\Admin\AppData\Roaming\OneDrive.exe
      "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6124
      • C:\Windows\SYSTEM32\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\OneDrive.exe" "OneDrive.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:1844
    • C:\Users\Admin\AppData\Roaming\Hazem pro.exe
      "C:\Users\Admin\AppData\Roaming\Hazem pro.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:5500
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004B8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Hazem pro.exe
    Filesize

    549KB

    MD5

    b896198c117a77a965f3b6a5d1d58f3d

    SHA1

    5f51edee59a2858e2b830cab8a86a37952a995c2

    SHA256

    51136630c2cff9f8fce660c89a5a81409ad6fddfebcc5fefdfaea21040fa020b

    SHA512

    ccbba8e6a573ff0e461afb5f22d7a3bb8e03c43caa71d685a906d8b32f82b9367ce34de9731ed4fcb2494d6f1a6fd06f3f46f4f84f40ea485d3761110e878ab0

    Download Submit

  • C:\Users\Admin\AppData\Roaming\OneDrive.exe
    Filesize

    785KB

    MD5

    3bb4bcf94cbdc788e8f6cf4d38be466f

    SHA1

    ec15d0cdc8f5f021b0c0e3d3b09a9ea8a1012545

    SHA256

    96a4a6b8b82eacb3f6e6735462a13a79f24237a78fe40158c36f7271ba232347

    SHA512

    ef43eb5c02da4236d7876a096a73341415e4311f4460ab7583f776e443ef247c575ce8014ad58d75781e36728ba19169265ad08181b6b3b48e39a00676b7e00b

    Download Submit

  • memory/5500-36-0x00000000009E0000-0x00000000009F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5500-31-0x00000000009E0000-0x00000000009F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5856-0-0x00007FFFB4833000-0x00007FFFB4835000-memory.dmp

    Filesize

    8KB

    Download

  • memory/5856-1-0x0000000000B90000-0x0000000000CEA000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/6124-29-0x000000001BC00000-0x000000001BCA6000-memory.dmp

    Filesize

    664KB

    Download

  • memory/6124-28-0x000000001BAB0000-0x000000001BB4C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/6124-27-0x00007FFFB1180000-0x00007FFFB1B21000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/6124-30-0x00007FFFB1180000-0x00007FFFB1B21000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/6124-26-0x000000001B5E0000-0x000000001BAAE000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/6124-32-0x0000000000CA0000-0x0000000000CA8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/6124-33-0x000000001BD20000-0x000000001BD6C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/6124-34-0x00007FFFB1435000-0x00007FFFB1436000-memory.dmp

    Filesize

    4KB

    Download

  • memory/6124-35-0x00007FFFB1180000-0x00007FFFB1B21000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/6124-13-0x00007FFFB1435000-0x00007FFFB1436000-memory.dmp

    Filesize

    4KB

    Download

  • memory/6124-37-0x000000001C180000-0x000000001C190000-memory.dmp

    Filesize

    64KB

    Download