Analysis
- max time kernel
151s - max time network
146s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe
- Size 101KB
- Sample201110-4r252ddj7s
- SHA256 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049
- MD5 b833665eb13b04fdd824d5a75eaa470a
- SHA1 4d67ddb18c2e34d1533d2f20f6fcf5526a1022d7
- SHA512 8dae7490cd41c3f00db9e62fff1681428bac30b44e84f41e635543257d47ade1bc61f9be495ff29ba8f11024aa656bf145532d1c3db8a988cdb2623e1ce34624
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1240 chargeable.exe 1636 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Loads dropped DLL 2 IoCs
pid Process 1588 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 1588 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe" da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1240 set thread context of 1636 1240 chargeable.exe 30 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe Token: 33 1636 chargeable.exe Token: SeIncBasePriorityPrivilege 1636 chargeable.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1240 1588 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 29 PID 1588 wrote to memory of 1240 1588 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 29 PID 1588 wrote to memory of 1240 1588 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 29 PID 1588 wrote to memory of 1240 1588 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 29 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1240 wrote to memory of 1636 1240 chargeable.exe 30 PID 1636 wrote to memory of 1996 1636 chargeable.exe 31 PID 1636 wrote to memory of 1996 1636 chargeable.exe 31 PID 1636 wrote to memory of 1996 1636 chargeable.exe 31 PID 1636 wrote to memory of 1996 1636 chargeable.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe"C:\Users\Admin\AppData\Local\Temp\da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:1996
-
-
-