Analysis
- max time kernel
146s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe
- Size 98KB
- Sample201109-2wtq3j28mx
- SHA256 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69
- MD5 a1f2fc1663d0feb1b31bf3d2b0096bb9
- SHA1 05a527a1b1cf7dc12a6899b84437c44d57e5f17b
- SHA512 56318e77d206cd3d9e82186edda6087f1c34d43b2d551d0d7206eb55b1b14058cc820e82f5dbc52dc181a33f88312aea242638ab2d7343a7d9d20c933892286b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1268 chargeable.exe 324 chargeable.exe 1628 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Loads dropped DLL 2 IoCs
pid Process 1704 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe 1704 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe" c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1268 set thread context of 324 1268 chargeable.exe 31 PID 1268 set thread context of 1628 1268 chargeable.exe 30 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe Token: 33 324 chargeable.exe Token: SeIncBasePriorityPrivilege 324 chargeable.exe - Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1268 1704 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe 29 PID 1704 wrote to memory of 1268 1704 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe 29 PID 1704 wrote to memory of 1268 1704 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe 29 PID 1704 wrote to memory of 1268 1704 c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe 29 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 324 1268 chargeable.exe 31 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 1268 wrote to memory of 1628 1268 chargeable.exe 30 PID 324 wrote to memory of 524 324 chargeable.exe 32 PID 324 wrote to memory of 524 324 chargeable.exe 32 PID 324 wrote to memory of 524 324 chargeable.exe 32 PID 324 wrote to memory of 524 324 chargeable.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe"C:\Users\Admin\AppData\Local\Temp\c8bc98c031af422824eb12cd8dcf61b8e1844aea010134692c1f3d4b8bedae69.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
PID:1628
-
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:524
-
-
-