Analysis
- max time kernel
148s - max time network
146s - platform
windows10_x64 - resource
win10v20201028 - submitted
10/11/2020, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe
- Size 97KB
- Sample201110-rlh5mrf6y2
- SHA256 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4
- MD5 b1c3297b610317e4399c9d9b8fb9423d
- SHA1 260558a8b6e0bc2612fa1622a855478244b01e46
- SHA512 0078c1ba7fcfc2d8febfb7c88699cd66ca05e2f1f5f80b38d494a54ae779b40b60e578e7d0b0b0613d24b31b67ff4ace18aa7454898efdcadf860b632a111390
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3408 chargeable.exe 3320 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe" 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3408 set thread context of 3320 3408 chargeable.exe 79 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe Token: 33 3320 chargeable.exe Token: SeIncBasePriorityPrivilege 3320 chargeable.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3008 wrote to memory of 3408 3008 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe 78 PID 3008 wrote to memory of 3408 3008 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe 78 PID 3008 wrote to memory of 3408 3008 5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe 78 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3408 wrote to memory of 3320 3408 chargeable.exe 79 PID 3320 wrote to memory of 2900 3320 chargeable.exe 80 PID 3320 wrote to memory of 2900 3320 chargeable.exe 80 PID 3320 wrote to memory of 2900 3320 chargeable.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe"C:\Users\Admin\AppData\Local\Temp\5d50a9bbbd7d28c608807cda0a40675ba59e0418585527cb0d173ccbe9f397e4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:2900
-
-
-