Overview
overview
10Static
static
1067a62cb441...ba.exe
windows7-x64
1067a62cb441...ba.exe
windows10-2004-x64
1067c679ac1d...4d.exe
windows7-x64
1067c679ac1d...4d.exe
windows10-2004-x64
1067e080e7fb...78.exe
windows7-x64
1067e080e7fb...78.exe
windows10-2004-x64
1067e78da23e...0e.exe
windows7-x64
867e78da23e...0e.exe
windows10-2004-x64
867e9ff3c0b...3e.exe
windows7-x64
767e9ff3c0b...3e.exe
windows10-2004-x64
7682b4b814e...27.exe
windows7-x64
10682b4b814e...27.exe
windows10-2004-x64
1068461a12fa...a4.exe
windows7-x64
1068461a12fa...a4.exe
windows10-2004-x64
1068921d96c9...34.exe
windows7-x64
1068921d96c9...34.exe
windows10-2004-x64
1068aaab301e...db.exe
windows7-x64
1068aaab301e...db.exe
windows10-2004-x64
1068b8408aa7...2b.exe
windows7-x64
768b8408aa7...2b.exe
windows10-2004-x64
768e912a390...88.exe
windows7-x64
1068e912a390...88.exe
windows10-2004-x64
1068fef6943e...6c.exe
windows7-x64
1068fef6943e...6c.exe
windows10-2004-x64
10691fe746ab...24.exe
windows7-x64
8691fe746ab...24.exe
windows10-2004-x64
8692a24fa9e...4b.exe
windows7-x64
10692a24fa9e...4b.exe
windows10-2004-x64
1069319ee860...9e.exe
windows7-x64
769319ee860...9e.exe
windows10-2004-x64
76947cb60fe...09.exe
windows7-x64
16947cb60fe...09.exe
windows10-2004-x64
1Analysis
-
max time kernel
71s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:12
Behavioral task
behavioral1
Sample
67a62cb441400a13757721a9f7d8c6ba.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
67a62cb441400a13757721a9f7d8c6ba.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
67c679ac1d31b57180ad84a2ccd0a74d.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral4
Sample
67c679ac1d31b57180ad84a2ccd0a74d.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
67e080e7fb0b34b6c79705d7689afc78.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
67e080e7fb0b34b6c79705d7689afc78.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
67e78da23e09ae504200e107f8bd9c60081203120fd9f7abb56696c552dc520e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
67e78da23e09ae504200e107f8bd9c60081203120fd9f7abb56696c552dc520e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
67e9ff3c0b908ed9076058d06270b856681178ce2e7d35867d1f5f75b715353e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
67e9ff3c0b908ed9076058d06270b856681178ce2e7d35867d1f5f75b715353e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
682b4b814ea823587a4f3c3d6c7bc1b59baece364d2b670fd3e45e798afeac27.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
682b4b814ea823587a4f3c3d6c7bc1b59baece364d2b670fd3e45e798afeac27.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
68461a12fa99132c70d16fe56ad023eec0f3813ac15c52eb407d7422716fa0a4.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral14
Sample
68461a12fa99132c70d16fe56ad023eec0f3813ac15c52eb407d7422716fa0a4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
68921d96c994564496baf8e8befa5834.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
68921d96c994564496baf8e8befa5834.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
68aaab301e4dc976a9ee18a646fab60e01c839867d05d24df6dad31b95e6aedb.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
68aaab301e4dc976a9ee18a646fab60e01c839867d05d24df6dad31b95e6aedb.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
68b8408aa7c238f2f6646abb8c2ff32b.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral20
Sample
68b8408aa7c238f2f6646abb8c2ff32b.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
68e912a390ec3a616480c7e3f1330988.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
68e912a390ec3a616480c7e3f1330988.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
68fef6943ee096474fd5049bb302656c.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral24
Sample
68fef6943ee096474fd5049bb302656c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
691fe746ab84ce9cc21d871e1c3f9b24.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
691fe746ab84ce9cc21d871e1c3f9b24.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
692a24fa9e70407c4d311a134752a34b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
692a24fa9e70407c4d311a134752a34b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
69319ee8609b1c1eebe97dc2bdf84c9e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
69319ee8609b1c1eebe97dc2bdf84c9e.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
6947cb60fed661aec1436b0ed5b443e13f6985da262967c2a9eb8160b1064e09.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
6947cb60fed661aec1436b0ed5b443e13f6985da262967c2a9eb8160b1064e09.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
68921d96c994564496baf8e8befa5834.exe
-
Size
55KB
-
MD5
68921d96c994564496baf8e8befa5834
-
SHA1
d866bee6645fdf339f6d3a29933e92397c77cd5a
-
SHA256
4d80ed9f81ceb1d9e284b89c0b074d6b03bdf94f2a0fa56c114f9143d6f1f654
-
SHA512
e6e23835cb12827616dd1a12757efba94d80cdca6ff51def8de944a3a461bdc1a77c4177c38fa8b635b4c83ac61f222a3ad52abfb38fcbad444442b88239cc64
-
SSDEEP
768:19OecKt1ManMy2Nrjyjyn3UhkSN0mwFvfu0YMDHPs2L7XJSxI3pmum:1984DnANrjyjmADRwsNMDFXExI3pmum
Malware Config
Signatures
-
Njrat family
-
Stops running service(s) 4 TTPs
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d86002942e50fc369331de21e4537b9f.exe 68921d96c994564496baf8e8befa5834.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d86002942e50fc369331de21e4537b9f.exe 68921d96c994564496baf8e8befa5834.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\d86002942e50fc369331de21e4537b9f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\68921d96c994564496baf8e8befa5834.exe\" .." 68921d96c994564496baf8e8befa5834.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\d86002942e50fc369331de21e4537b9f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\68921d96c994564496baf8e8befa5834.exe\" .." 68921d96c994564496baf8e8befa5834.exe -
pid Process 2568 powershell.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2596 sc.exe 2456 sc.exe 2424 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68921d96c994564496baf8e8befa5834.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe 3068 68921d96c994564496baf8e8befa5834.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3068 68921d96c994564496baf8e8befa5834.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: SeDebugPrivilege 2568 powershell.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe Token: 33 3068 68921d96c994564496baf8e8befa5834.exe Token: SeIncBasePriorityPrivilege 3068 68921d96c994564496baf8e8befa5834.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2672 3068 68921d96c994564496baf8e8befa5834.exe 28 PID 3068 wrote to memory of 2672 3068 68921d96c994564496baf8e8befa5834.exe 28 PID 3068 wrote to memory of 2672 3068 68921d96c994564496baf8e8befa5834.exe 28 PID 3068 wrote to memory of 2672 3068 68921d96c994564496baf8e8befa5834.exe 28 PID 3068 wrote to memory of 2728 3068 68921d96c994564496baf8e8befa5834.exe 30 PID 3068 wrote to memory of 2728 3068 68921d96c994564496baf8e8befa5834.exe 30 PID 3068 wrote to memory of 2728 3068 68921d96c994564496baf8e8befa5834.exe 30 PID 3068 wrote to memory of 2728 3068 68921d96c994564496baf8e8befa5834.exe 30 PID 2728 wrote to memory of 2568 2728 cmd.exe 32 PID 2728 wrote to memory of 2568 2728 cmd.exe 32 PID 2728 wrote to memory of 2568 2728 cmd.exe 32 PID 2728 wrote to memory of 2568 2728 cmd.exe 32 PID 3068 wrote to memory of 2752 3068 68921d96c994564496baf8e8befa5834.exe 33 PID 3068 wrote to memory of 2752 3068 68921d96c994564496baf8e8befa5834.exe 33 PID 3068 wrote to memory of 2752 3068 68921d96c994564496baf8e8befa5834.exe 33 PID 3068 wrote to memory of 2752 3068 68921d96c994564496baf8e8befa5834.exe 33 PID 2752 wrote to memory of 2424 2752 cmd.exe 35 PID 2752 wrote to memory of 2424 2752 cmd.exe 35 PID 2752 wrote to memory of 2424 2752 cmd.exe 35 PID 2752 wrote to memory of 2424 2752 cmd.exe 35 PID 3068 wrote to memory of 2820 3068 68921d96c994564496baf8e8befa5834.exe 36 PID 3068 wrote to memory of 2820 3068 68921d96c994564496baf8e8befa5834.exe 36 PID 3068 wrote to memory of 2820 3068 68921d96c994564496baf8e8befa5834.exe 36 PID 3068 wrote to memory of 2820 3068 68921d96c994564496baf8e8befa5834.exe 36 PID 2820 wrote to memory of 2596 2820 cmd.exe 38 PID 2820 wrote to memory of 2596 2820 cmd.exe 38 PID 2820 wrote to memory of 2596 2820 cmd.exe 38 PID 2820 wrote to memory of 2596 2820 cmd.exe 38 PID 3068 wrote to memory of 2512 3068 68921d96c994564496baf8e8befa5834.exe 39 PID 3068 wrote to memory of 2512 3068 68921d96c994564496baf8e8befa5834.exe 39 PID 3068 wrote to memory of 2512 3068 68921d96c994564496baf8e8befa5834.exe 39 PID 3068 wrote to memory of 2512 3068 68921d96c994564496baf8e8befa5834.exe 39 PID 2512 wrote to memory of 2456 2512 cmd.exe 41 PID 2512 wrote to memory of 2456 2512 cmd.exe 41 PID 2512 wrote to memory of 2456 2512 cmd.exe 41 PID 2512 wrote to memory of 2456 2512 cmd.exe 41 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2672 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68921d96c994564496baf8e8befa5834.exe"C:\Users\Admin\AppData\Local\Temp\68921d96c994564496baf8e8befa5834.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\attrib.exeattrib +h "C:\Users\Admin\AppData\Local\Temp\68921d96c994564496baf8e8befa5834.exe"2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2672
-
-
C:\Windows\SysWOW64\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc query windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\sc.exesc query windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc stop windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\sc.exesc stop windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc delete windefend2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\sc.exesc delete windefend3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2456
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1