netdooka | 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642

General

Target

28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe
Size

96KB
MD5

d2648d277a22b438236af3bfe5421582
SHA1

146489af6ee05c0504bd37896435e03ee0d8f261
SHA256

28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642
SHA512

9f61b856d199e316ab88578d977950537d87e101c5c33ec857d52688b582f2dbd3b5bcfbb5386bbfb7cd1fc9aaeb3b412a7d603bf31544fe35c4198dfafba1ef

Score

10^/10

netdooka loader persistence rat

Malware Config

Extracted

Family

netdooka

C2

93.115.21.45

Signatures

NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
loader rat netdooka

Executes dropped EXE 1 IoCs

pid	Process
1052	ougdwieue.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SolidTechnology\config.cfg	ougdwieue.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1700	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ougdwieue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ougdwieue.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1984	ping.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1052	ougdwieue.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	ougdwieue.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: 33	1484	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1484	AUDIODG.EXE
Token: 33	1484	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1484	AUDIODG.EXE
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe
Token: SeShutdownPrivilege	1728	explorer.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe
1728	explorer.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1984	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	27
PID 1348 wrote to memory of 1984	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	27
PID 1348 wrote to memory of 1984	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	27
PID 1348 wrote to memory of 1700	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	29
PID 1348 wrote to memory of 1700	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	29
PID 1348 wrote to memory of 1700	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	29
PID 1348 wrote to memory of 1052	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	31
PID 1348 wrote to memory of 1052	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	31
PID 1348 wrote to memory of 1052	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	31
PID 1348 wrote to memory of 1052	1348	28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe	31
PID 1052 wrote to memory of 112	1052	ougdwieue.exe	33
PID 1052 wrote to memory of 112	1052	ougdwieue.exe	33
PID 1052 wrote to memory of 112	1052	ougdwieue.exe	33
PID 1052 wrote to memory of 112	1052	ougdwieue.exe	33
PID 112 wrote to memory of 1728	112	runas.exe	34
PID 112 wrote to memory of 1728	112	runas.exe	34
PID 112 wrote to memory of 1728	112	runas.exe	34
PID 112 wrote to memory of 1728	112	runas.exe	34
PID 1728 wrote to memory of 676	1728	explorer.exe	35
PID 1728 wrote to memory of 676	1728	explorer.exe	35
PID 1728 wrote to memory of 676	1728	explorer.exe	35

C:\Users\Admin\AppData\Local\Temp\28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe
"C:\Users\Admin\AppData\Local\Temp\28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\ping.exe
  "ping.exe" 1.2.3.4 -n 2
  2⤵
  - Runs ping.exe
  PID:1984
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" start protdrv
  2⤵
  - Launches sc.exe
  PID:1700
- C:\Users\Admin\AppData\Local\Temp\ougdwieue.exe
  "C:\Users\Admin\AppData\Local\Temp\\ougdwieue.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\runas.exe
    runas /trustlevel:0x20000 C:\Windows\explorer.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:112
  - - C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      4⤵
      Modifies Installed Components in the registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x108
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ougdwieue.exe

Filesize
88KB

MD5
6e5359512d113b246e085e39d9a950d7

SHA1
a29470ea2f32ffc8389aba74af1ee26e282ccc9a

SHA256
ab7d39e34ad51bc3138fb4d0f7dedc4668be1d4b54a45c385e661869267ef685

SHA512
cca7543efb7412a7ced80aa0a9227bdaae5959f7ecafc4a659e0f4d0ddb15e4ed7c7cb07314f04b47211e6c700f005d3aeee06e6eea847398fd804b78f4325d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ougdwieue.exe

Filesize
88KB

MD5
6e5359512d113b246e085e39d9a950d7

SHA1
a29470ea2f32ffc8389aba74af1ee26e282ccc9a

SHA256
ab7d39e34ad51bc3138fb4d0f7dedc4668be1d4b54a45c385e661869267ef685

SHA512
cca7543efb7412a7ced80aa0a9227bdaae5959f7ecafc4a659e0f4d0ddb15e4ed7c7cb07314f04b47211e6c700f005d3aeee06e6eea847398fd804b78f4325d0

Download Submit
memory/1052-68-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/1052-61-0x0000000074E81000-0x0000000074E83000-memory.dmp

Filesize
8KB

Download
memory/1052-67-0x00000000742A0000-0x000000007484B000-memory.dmp

Filesize
5.7MB

Download
memory/1348-56-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1348-54-0x000007FEF33A0000-0x000007FEF3DC3000-memory.dmp

Filesize
10.1MB

Download

Analysis

Sharing