Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe
- Size 99KB
- Sample201110-pbapka9apj
- SHA256 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97
- MD5 a98c2865371f94d5f8482d6c21e85522
- SHA1 1c34c168592dfa053d2991c64f9d101c43613db4
- SHA512 c40b3679576c3906a4b1859594ae514f9535a2d936c3724d89c7514bb23bc244818a5edbbd03d047a166bcf2901d33acb7928d71064027ddb9c25563ff1387f1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1992 chargeable.exe 2692 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe" 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1992 set thread context of 2692 1992 chargeable.exe 80 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe Token: 33 2692 chargeable.exe Token: SeIncBasePriorityPrivilege 2692 chargeable.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 480 wrote to memory of 1992 480 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe 79 PID 480 wrote to memory of 1992 480 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe 79 PID 480 wrote to memory of 1992 480 45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe 79 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 1992 wrote to memory of 2692 1992 chargeable.exe 80 PID 2692 wrote to memory of 1104 2692 chargeable.exe 81 PID 2692 wrote to memory of 1104 2692 chargeable.exe 81 PID 2692 wrote to memory of 1104 2692 chargeable.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe"C:\Users\Admin\AppData\Local\Temp\45e774876884d29f53659c6e2962858fcb70a77902e07e44ea2b30f8c65cbf97.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:1104
-
-
-