Analysis
-
max time kernel
893s -
max time network
897s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2025, 05:02
Behavioral task
behavioral1
Sample
vodd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
13 signatures
900 seconds
Behavioral task
behavioral2
Sample
vodd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
7 signatures
900 seconds
Behavioral task
behavioral3
Sample
vodd.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral4
Sample
vodd.exe
Resource
win11-20250313-en
windows11-21h2-x64
7 signatures
900 seconds
General
-
Target
vodd.exe
-
Size
93KB
-
MD5
c13fd2efd94960fae11cd9f78ee9f090
-
SHA1
3855d7f6f42048ab3895e213e5d1847df7c9641e
-
SHA256
aa964bd196342fb080c53443b85cdcea6e117ada3eebe95043f23e264137d154
-
SHA512
541c367480d91ec10ac7eeb7a6c7aabe1f74c2b408b6c27362590b87eed0956e0396285c8c5c61a843a04a015c2cbcb642c8987669792ad865c120606d65a380
-
SSDEEP
1536:LU/r7EkrjaFIs7E5Ox8Jn8LjEwzGi1dD1DygS:LU7jau5OKVni1dpX
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
HacKed
C2
hakim32.ddns.net:2000
26.215.185.49:5552
Mutex
57bba9c26679cdd8eee0bb90aa915a71
Attributes
-
reg_key
57bba9c26679cdd8eee0bb90aa915a71
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5108 netsh.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57bba9c26679cdd8eee0bb90aa915a71Windows Update.exe vodd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\57bba9c26679cdd8eee0bb90aa915a71Windows Update.exe vodd.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\57bba9c26679cdd8eee0bb90aa915a71windows update.exe taskmgr.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vodd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2272 vodd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: SeDebugPrivilege 1332 taskmgr.exe Token: SeSystemProfilePrivilege 1332 taskmgr.exe Token: SeCreateGlobalPrivilege 1332 taskmgr.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 1332 taskmgr.exe Token: SeIncBasePriorityPrivilege 1332 taskmgr.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe Token: 33 2272 vodd.exe Token: SeIncBasePriorityPrivilege 2272 vodd.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe 1332 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2272 wrote to memory of 5108 2272 vodd.exe 90 PID 2272 wrote to memory of 5108 2272 vodd.exe 90 PID 2272 wrote to memory of 5108 2272 vodd.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\vodd.exe"C:\Users\Admin\AppData\Local\Temp\vodd.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\vodd.exe" "vodd.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5108
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1332
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\57bba9c26679cdd8eee0bb90aa915a71windows update.exe
Filesize93KB
MD5c13fd2efd94960fae11cd9f78ee9f090
SHA13855d7f6f42048ab3895e213e5d1847df7c9641e
SHA256aa964bd196342fb080c53443b85cdcea6e117ada3eebe95043f23e264137d154
SHA512541c367480d91ec10ac7eeb7a6c7aabe1f74c2b408b6c27362590b87eed0956e0396285c8c5c61a843a04a015c2cbcb642c8987669792ad865c120606d65a380