Analysis
- max time kernel
149s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe
- Size 101KB
- Sample201110-4r252ddj7s
- SHA256 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049
- MD5 b833665eb13b04fdd824d5a75eaa470a
- SHA1 4d67ddb18c2e34d1533d2f20f6fcf5526a1022d7
- SHA512 8dae7490cd41c3f00db9e62fff1681428bac30b44e84f41e635543257d47ade1bc61f9be495ff29ba8f11024aa656bf145532d1c3db8a988cdb2623e1ce34624
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1932 chargeable.exe 752 chargeable.exe 1560 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe" da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1932 set thread context of 752 1932 chargeable.exe 80 PID 1932 set thread context of 1560 1932 chargeable.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3896 1560 WerFault.exe 79 - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe Token: 33 752 chargeable.exe Token: SeIncBasePriorityPrivilege 752 chargeable.exe - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4048 wrote to memory of 1932 4048 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 78 PID 4048 wrote to memory of 1932 4048 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 78 PID 4048 wrote to memory of 1932 4048 da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe 78 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 752 1932 chargeable.exe 80 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 1932 wrote to memory of 1560 1932 chargeable.exe 79 PID 752 wrote to memory of 1368 752 chargeable.exe 83 PID 752 wrote to memory of 1368 752 chargeable.exe 83 PID 752 wrote to memory of 1368 752 chargeable.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe"C:\Users\Admin\AppData\Local\Temp\da14a4e7c900e429ffb16b7f89e27216fc9befbc909af78e9677e435197ee049.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 884⤵
- Program crash
PID:3896
-
-
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:1368
-
-
-