Analysis
- max time kernel
148s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe
- Size 98KB
- Sample201109-cdfpqs2j4n
- SHA256 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b
- MD5 f794d8a8fafb2c7e68da1961030b2fbc
- SHA1 ab5531bc63c65d3cefa98b407221b655dd48a90e
- SHA512 7bb6cfe50e6a6e4c082823c50ca2407be2a360a0e1df0f4bbd6c5518dfaf14b5f8b66a7576c43f2005b629bd13fa835137458a6ca89f71bd72458ae1c3db3832
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1508 chargeable.exe 2908 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe" 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1508 set thread context of 2908 1508 chargeable.exe 80 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe Token: 33 2908 chargeable.exe Token: SeIncBasePriorityPrivilege 2908 chargeable.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4068 wrote to memory of 1508 4068 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe 79 PID 4068 wrote to memory of 1508 4068 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe 79 PID 4068 wrote to memory of 1508 4068 41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe 79 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 1508 wrote to memory of 2908 1508 chargeable.exe 80 PID 2908 wrote to memory of 3108 2908 chargeable.exe 81 PID 2908 wrote to memory of 3108 2908 chargeable.exe 81 PID 2908 wrote to memory of 3108 2908 chargeable.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe"C:\Users\Admin\AppData\Local\Temp\41372f3f369d6be620fd69cb01d60a6fd28c9094e6ce647a0abe941f4b79010b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:3108
-
-
-