Overview

overview

10

Static

static

5c14a72a6b...54.exe

windows7_x64

10

5c14a72a6b...54.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.bin

  • Size

    47KB

  • Sample

    220610-s2wxgahba9

  • MD5

    0d225faf96ee8d83cb69fbfcceba98bc

  • SHA1

    a7b3c081b405cccfd55b8e64a6922fbc69bd733c

  • SHA256

    5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54

  • SHA512

    dbc0501e031e711a756519dd4dbe83fc18ecc2f25fed205ef5d9fdc7b9e54e5dd6995250bcfa494e26e8f12a497842987af490f82d787033931306aec07edfd9

Score
10/10
netdookaloaderpersistencerat

Malware Config

Extracted

Family

netdooka

C2

http://93.115.21.45/gtaddress

Targets

    • Target

      5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54.bin

    • Size

      47KB

    • MD5

      0d225faf96ee8d83cb69fbfcceba98bc

    • SHA1

      a7b3c081b405cccfd55b8e64a6922fbc69bd733c

    • SHA256

      5c14a72a6b73b422cafc2596c13897937013fd335eca4299e63d01adee727d54

    • SHA512

      dbc0501e031e711a756519dd4dbe83fc18ecc2f25fed205ef5d9fdc7b9e54e5dd6995250bcfa494e26e8f12a497842987af490f82d787033931306aec07edfd9

    Score
    10/10
    netdookaloaderpersistencerat

    • NetDooka

      NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.

      loaderratnetdooka

    • Creates new service(s)

      persistence

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Deletes itself

    • Checks for any installed AV software in registry

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

New Service

1
T1050

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Security Software Discovery

1
T1063

System Information Discovery

3
T1082

Query Registry

2
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks