Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 15:35
Static task
static1
Behavioral task
behavioral1
Sample
17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe
- Size 331KB
- Sample201113-dryba6lfhe
- SHA256 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555
- MD5 1b28469552abb5d1f3773d84219c49e5
- SHA1 df47f1531eeddc7cfc06ecda945724b6aefc3a6f
- SHA512 d4a91f98a36ab6c24d6b909bdbc334574c743f0cf3f309f909abf56565882657aebce199ea85cd7e2647b0300c32675b70586c556e79bc90d459e39d190048a4
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
HacKed
C2
-
127.0.0.1:5552
Mutex
-
e83af6d5ff692b69cb0ee3ea3a7e3fe0
Attributes
-
reg_key
e83af6d5ff692b69cb0ee3ea3a7e3fe0
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2028 cutedoodles.exe 896 cutedoodles.exe - Modifies Windows Firewall 1 TTPs
- Loads dropped DLL 4 IoCs
pid Process 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 2028 cutedoodles.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe Token: 33 896 cutedoodles.exe Token: SeIncBasePriorityPrivilege 896 cutedoodles.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 288 wrote to memory of 2028 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 26 PID 288 wrote to memory of 2028 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 26 PID 288 wrote to memory of 2028 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 26 PID 288 wrote to memory of 2028 288 17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe 26 PID 2028 wrote to memory of 896 2028 cutedoodles.exe 30 PID 2028 wrote to memory of 896 2028 cutedoodles.exe 30 PID 2028 wrote to memory of 896 2028 cutedoodles.exe 30 PID 2028 wrote to memory of 896 2028 cutedoodles.exe 30 PID 896 wrote to memory of 1684 896 cutedoodles.exe 31 PID 896 wrote to memory of 1684 896 cutedoodles.exe 31 PID 896 wrote to memory of 1684 896 cutedoodles.exe 31 PID 896 wrote to memory of 1684 896 cutedoodles.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe"C:\Users\Admin\AppData\Local\Temp\17cdfe9fa78ee6ab72302c300ba976410f3f53a697a9953c6f22cce20eaae555.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cutedoodles.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\cutedoodles.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe"C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cutedoodles.exe" "cutedoodles.exe" ENABLE4⤵PID:1684
-
-
-