netdooka | 76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086

Analysis

Target

76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe
Size

218KB
MD5

7804c8a590250469feed31c85da8acf3
SHA1

bdc5e81cf0cdb4b09f8e05826110b42b78e1bd16
SHA256

76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086
SHA512

17743414c5e80686dd0124661570533791df27f14c75452e89e0de5030b2535f2edac4bad349168e2564aee0058f539eec4dc1899b29713d9d90f5b0f8e450a5

Score

10^/10

netdooka loader rat

Family

netdooka

http://93.115.21.45/gtaddress

NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
loader rat netdooka
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1740 848 WerFault.exe 76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1956 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe

description pid process

Token: SeDebugPrivilege 848 76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe

pid	pid_target	process	target process
1740	848	WerFault.exe	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe

pid	process
1956	PING.EXE

description	pid	process
Token: SeDebugPrivilege	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe

description	pid	process	target process
PID 848 wrote to memory of 1956	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe	PING.EXE
PID 848 wrote to memory of 1956	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe	PING.EXE
PID 848 wrote to memory of 1956	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe	PING.EXE
PID 848 wrote to memory of 1740	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe	WerFault.exe
PID 848 wrote to memory of 1740	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe	WerFault.exe
PID 848 wrote to memory of 1740	848	76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe
"C:\Users\Admin\AppData\Local\Temp\76ed2ef41db9ec357168cd38daeff1079458af868a037251d3fec36de1b72086.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\System32\PING.EXE
  "C:\Windows\System32\PING.EXE" 23.18.9.8 -n 3
  2⤵
  - Runs ping.exe
  PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 848 -s 1244
  2⤵
  - Program crash
  PID:1740

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/848-54-0x0000000000AD0000-0x0000000000B0C000-memory.dmp

Filesize
240KB

Download
memory/848-55-0x000007FEFC081000-0x000007FEFC083000-memory.dmp

Filesize
8KB

Download
memory/1740-57-0x0000000000000000-mapping.dmp

Download
memory/1956-56-0x0000000000000000-mapping.dmp

Download