9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152

General

Target
9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
Size 7.4MB
Sample260930-nrat2aec44
SHA256 9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152
MD5 aa05e227901cf572661cd808df1eee03
SHA1 f2a3c0a9b691174913a51002a7accd1318c1949a
SHA512 642070a47dfccc43744a826986b2e637f1683b0ad65fa9359169a5a8ad8bb683ae3c2318b5fb6b53ad6e348bcb52ab1019881ecb3fe6af4d7c93a5d20a776b6e
SSDEEP 49152:1Xd4953efQHfAvE8YVmhauVc2W1N8hyEcWXFeCo3xSVQoxE/o7ERjXXynaJpKCK0:1aXuI0E8YMSErmhSF7b7xEuq
TLSH
T1E6765B07ECA514E9C0AED1308A6695137B31BC895B3263D71B90F6287F73BE4ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1492	netsh.exe
4672	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4680	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3044	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3528	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
4680	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3044	3528	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe	85
PID 3528 wrote to memory of 1492	3528	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe	87
PID 3528 wrote to memory of 4672	3528	9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe	91

C:\Users\Admin\AppData\Local\Temp\9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
"C:\Users\Admin\AppData\Local\Temp\9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Windows\system32\sc.exe
  sc.exe query NetworkSvc
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall show rule "name=Network Sync Support"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1492
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule "name=Network Sync Support" dir=in action=allow protocol=TCP localport=28080 profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4672

C:\ProgramData\NetworkSvc\9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
C:\ProgramData\NetworkSvc\9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe

Path C:\ProgramData\NetworkSvc\9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152.exe
Size 7.4MB
SHA256 9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152
MD5 aa05e227901cf572661cd808df1eee03
SHA1 f2a3c0a9b691174913a51002a7accd1318c1949a
SHA512 642070a47dfccc43744a826986b2e637f1683b0ad65fa9359169a5a8ad8bb683ae3c2318b5fb6b53ad6e348bcb52ab1019881ecb3fe6af4d7c93a5d20a776b6e
SSDEEP 49152:1Xd4953efQHfAvE8YVmhauVc2W1N8hyEcWXFeCo3xSVQoxE/o7ERjXXynaJpKCK0:1aXuI0E8YMSErmhSF7b7xEuq
TLSH
T1E6765B07ECA514E9C0AED1308A6695137B31BC895B3263D71B90F6287F73BE4ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\ProgramData\NetworkSvc\config.json
Size 326B
SHA256 f05712c3cb7dfbb0f9f28688421df3b4c5c8d25ffe9cf34d3b3d731a1a93e8ca
MD5 c276a89ffb7f45175e1587724fb2bcfa
SHA1 dcf1302ba9c70789609d5af1adaacbc4d0c243f2
SHA512 19a0d9729db1eaf9db9d18f20a5ead52441c3445c8f4919cdc0d28bc560e01f8a35c625bfc18a138729297f5b89718b7bb35e0c85af0f11cd5182ed7906833ba
TLSH
T162E07846E396CD084E5D9B290D675E05EDF54DC3ED50F07F4DC1211D16505D4F94F940
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads