Analysis
- max time kernel
148s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe
- Size 98KB
- Sample201109-272esrfva6
- SHA256 b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49
- MD5 ab05d0421c5ef0faa9284fb0a119c601
- SHA1 dadd912e1d5e853d9f6a48ce4ea57c996a256f57
- SHA512 f1389ae63d06815f702efa46e453dbf290d914852de5fd92ada95b7c1ec10b16d18d88920623c9075bcdf6fb21cb3bdfd27fe013c4701f1452f7991193daffd5
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3960 chargeable.exe 2704 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe" b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3960 set thread context of 2704 3960 chargeable.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe Token: 33 2704 chargeable.exe Token: SeIncBasePriorityPrivilege 2704 chargeable.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 984 wrote to memory of 3960 984 b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe 78 PID 984 wrote to memory of 3960 984 b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe 78 PID 984 wrote to memory of 3960 984 b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe 78 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 3960 wrote to memory of 2704 3960 chargeable.exe 79 PID 2704 wrote to memory of 420 2704 chargeable.exe 80 PID 2704 wrote to memory of 420 2704 chargeable.exe 80 PID 2704 wrote to memory of 420 2704 chargeable.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe"C:\Users\Admin\AppData\Local\Temp\b4cd64cd6ea7c31f5e568d6da93d6cfbc7c97d8d7829f27bf6702f2dc11ebf49.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:420
-
-
-