netdooka | 8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e

General

Target

8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe
Size

36KB
MD5

a00a73cdc75178a115112a584c5a4dbf
SHA1

0a862f5f6b8dd211e966e74a3de3e4f1224bae6d
SHA256

8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e
SHA512

91e30c84c03e46a9c232b7d628d280b841c5391be7e871b8b1b117422e41dd732a23ec8fe71126e1a38ac69ee1b7f190c666f637cf5cae358cac374c6d114cff

Score

10^/10

netdooka evasion loader persistence rat

Malware Config

Extracted

Family

netdooka

C2

http://93.115.21.45/gtaddress

Signatures

NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
loader rat netdooka
Creates new service(s) 1 TTPs
persistence

New Service
T1050

Executes dropped EXE 2 IoCs

pid	Process
584	min_id_resolver.exe
1180	min_id_resolver.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\Avira	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Avira	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\ExMultimediaStorage\min_id_resolver.exe	cmd.exe
File opened for modification	C:\Program Files\ExMultimediaStorage\min_id_resolver.exe	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
632	sc.exe
780	sc.exe
1392	sc.exe
1992	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1280	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1280	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	27
PID 1708 wrote to memory of 1280	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	27
PID 1708 wrote to memory of 1280	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	27
PID 1708 wrote to memory of 856	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	29
PID 1708 wrote to memory of 856	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	29
PID 1708 wrote to memory of 856	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	29
PID 1708 wrote to memory of 632	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	30
PID 1708 wrote to memory of 632	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	30
PID 1708 wrote to memory of 632	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	30
PID 1708 wrote to memory of 780	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	33
PID 1708 wrote to memory of 780	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	33
PID 1708 wrote to memory of 780	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	33
PID 1708 wrote to memory of 1392	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	36
PID 1708 wrote to memory of 1392	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	36
PID 1708 wrote to memory of 1392	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	36
PID 1708 wrote to memory of 1992	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	38
PID 1708 wrote to memory of 1992	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	38
PID 1708 wrote to memory of 1992	1708	8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe	38

C:\Users\Admin\AppData\Local\Temp\8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe
"C:\Users\Admin\AppData\Local\Temp\8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe"
1⤵
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\PING.EXE
  "C:\Windows\System32\PING.EXE" 22.61.56.108 -n 4
  2⤵
  - Runs ping.exe
  PID:1280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e.exe" "C:\Program Files\ExMultimediaStorage\min_id_resolver.exe"
  2⤵
  - Drops file in Program Files directory
  PID:856
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" create SecureElementDataSrv binpath= "C:\Program Files\ExMultimediaStorage\min_id_resolver.exe delected"
  2⤵
  - Launches sc.exe
  PID:632
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start SecureElementDataSrv
  2⤵
  - Launches sc.exe
  PID:780
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop SecureElementDataSrv
  2⤵
  - Launches sc.exe
  PID:1392
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start SecureElementDataSrv
  2⤵
  - Launches sc.exe
  PID:1992

C:\Program Files\ExMultimediaStorage\min_id_resolver.exe
"C:\Program Files\ExMultimediaStorage\min_id_resolver.exe" delected
1⤵
- Executes dropped EXE
PID:584

C:\Program Files\ExMultimediaStorage\min_id_resolver.exe
"C:\Program Files\ExMultimediaStorage\min_id_resolver.exe" delected
1⤵
- Executes dropped EXE
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

New Service

Privilege Escalation

New Service

1

T1050

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Remote System Discovery

1

T1018

Security Software Discovery

1

T1063

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\ExMultimediaStorage\min_id_resolver.exe

Filesize
36KB

MD5
a00a73cdc75178a115112a584c5a4dbf

SHA1
0a862f5f6b8dd211e966e74a3de3e4f1224bae6d

SHA256
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e

SHA512
91e30c84c03e46a9c232b7d628d280b841c5391be7e871b8b1b117422e41dd732a23ec8fe71126e1a38ac69ee1b7f190c666f637cf5cae358cac374c6d114cff

Download Submit
C:\Program Files\ExMultimediaStorage\min_id_resolver.exe

Filesize
36KB

MD5
a00a73cdc75178a115112a584c5a4dbf

SHA1
0a862f5f6b8dd211e966e74a3de3e4f1224bae6d

SHA256
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e

SHA512
91e30c84c03e46a9c232b7d628d280b841c5391be7e871b8b1b117422e41dd732a23ec8fe71126e1a38ac69ee1b7f190c666f637cf5cae358cac374c6d114cff

Download Submit
C:\Program Files\ExMultimediaStorage\min_id_resolver.exe

Filesize
36KB

MD5
a00a73cdc75178a115112a584c5a4dbf

SHA1
0a862f5f6b8dd211e966e74a3de3e4f1224bae6d

SHA256
8ed34bfc102f8217dcd6e6bdae2b9d4ee0f3ab951d44255e1e300dc2a38b219e

SHA512
91e30c84c03e46a9c232b7d628d280b841c5391be7e871b8b1b117422e41dd732a23ec8fe71126e1a38ac69ee1b7f190c666f637cf5cae358cac374c6d114cff

Download Submit
memory/584-62-0x000007FEF3350000-0x000007FEF3D73000-memory.dmp

Filesize
10.1MB

Download
memory/1180-66-0x000007FEF3350000-0x000007FEF3D73000-memory.dmp

Filesize
10.1MB

Download
memory/1708-54-0x000007FEF3350000-0x000007FEF3D73000-memory.dmp

Filesize
10.1MB

Download
memory/1708-55-0x000007FEFB871000-0x000007FEFB873000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing