Analysis
- max time kernel
151s - max time network
147s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe
- Size 101KB
- Sample201110-b92alfna36
- SHA256 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7
- MD5 a7581af1b2b9eba17f773af165102a78
- SHA1 b3669af789c1ee42086c2923ce08d4a6624cb81f
- SHA512 8619840f611d22f2c1047d382686f4ec8bb67ad007ca20ffdcde3b642d5bb07ce60382655f26ec109d7e585c898c94b77daf445d7887279251a1ff2ab4e86c1c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 316 chargeable.exe 604 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Loads dropped DLL 2 IoCs
pid Process 1936 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe 1936 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe" 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 316 set thread context of 604 316 chargeable.exe 30 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe Token: 33 604 chargeable.exe Token: SeIncBasePriorityPrivilege 604 chargeable.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1936 wrote to memory of 316 1936 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe 29 PID 1936 wrote to memory of 316 1936 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe 29 PID 1936 wrote to memory of 316 1936 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe 29 PID 1936 wrote to memory of 316 1936 0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe 29 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 316 wrote to memory of 604 316 chargeable.exe 30 PID 604 wrote to memory of 336 604 chargeable.exe 31 PID 604 wrote to memory of 336 604 chargeable.exe 31 PID 604 wrote to memory of 336 604 chargeable.exe 31 PID 604 wrote to memory of 336 604 chargeable.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe"C:\Users\Admin\AppData\Local\Temp\0f307c97b107d3c77e326437d067b600b73bb67663835ecb7ea833f90f2abab7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:336
-
-
-