Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
11/11/2020, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe
- Size 100KB
- Sample201111-cs4vvh36nx
- SHA256 c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258
- MD5 b992008383d75e8cc48647e6ef0cd261
- SHA1 421f0029f0845f3d34680788b3627db778ad753e
- SHA512 6b73f83f7c705505eec20eca16ab901371effcc74743e2f4ae9b333fd5b49b51b0b28c986153fc8543155f8831a3cee82e220a60080d86c309456029cd5fd97c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
neuf
C2
-
doddyfire.linkpc.net:10000
Mutex
-
e1a87040f2026369a233f9ae76301b7b
Attributes
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2568 chargeable.exe 2552 chargeable.exe - Modifies Windows Firewall 1 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe" c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2568 set thread context of 2552 2568 chargeable.exe 78 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe Token: 33 2552 chargeable.exe Token: SeIncBasePriorityPrivilege 2552 chargeable.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4004 wrote to memory of 2568 4004 c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe 77 PID 4004 wrote to memory of 2568 4004 c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe 77 PID 4004 wrote to memory of 2568 4004 c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe 77 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2568 wrote to memory of 2552 2568 chargeable.exe 78 PID 2552 wrote to memory of 2020 2552 chargeable.exe 79 PID 2552 wrote to memory of 2020 2552 chargeable.exe 79 PID 2552 wrote to memory of 2020 2552 chargeable.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe"C:\Users\Admin\AppData\Local\Temp\c122a727fca8bec4e5a0d0a600fc00592fd96b1d79d24f8f336ba79e66fe9258.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵PID:2020
-
-
-