Analysis
-
max time kernel
157s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 13:55
Static task
static1
Behavioral task
behavioral1
Sample
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe
Resource
win10v2004-20240412-en
General
-
Target
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe
-
Size
107KB
-
MD5
e53219c25838d5d1eba21c5608dba74d
-
SHA1
63b1c1c5ae014c01986c59a880209083823151b6
-
SHA256
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b
-
SHA512
f6e3bda1ba52e3d4865cb1e25a3b65091f3fd386d37a2144fee9bbeed331be926cf09e38fd226043416b4e18c2deff30d9ab97b7099532cb3f86d047e0ad6e4b
-
SSDEEP
1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOE:w5eznsjsguGDFqGx8egoxmOE
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 664 netsh.exe -
Executes dropped EXE 2 IoCs
Processes:
chargeable.exechargeable.exepid process 2568 chargeable.exe 2412 chargeable.exe -
Loads dropped DLL 2 IoCs
Processes:
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exepid process 2896 ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe 2896 ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe" ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chargeable.exedescription pid process target process PID 2568 set thread context of 2412 2568 chargeable.exe chargeable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
chargeable.exedescription pid process Token: SeDebugPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe Token: 33 2412 chargeable.exe Token: SeIncBasePriorityPrivilege 2412 chargeable.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exechargeable.exechargeable.exedescription pid process target process PID 2896 wrote to memory of 2568 2896 ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe chargeable.exe PID 2896 wrote to memory of 2568 2896 ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe chargeable.exe PID 2896 wrote to memory of 2568 2896 ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe chargeable.exe PID 2896 wrote to memory of 2568 2896 ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2568 wrote to memory of 2412 2568 chargeable.exe chargeable.exe PID 2412 wrote to memory of 664 2412 chargeable.exe netsh.exe PID 2412 wrote to memory of 664 2412 chargeable.exe netsh.exe PID 2412 wrote to memory of 664 2412 chargeable.exe netsh.exe PID 2412 wrote to memory of 664 2412 chargeable.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe"C:\Users\Admin\AppData\Local\Temp\ccd5489042e837a771f04a06fc5296535c2fff338e4d7b6d0585f446f2b0ba6b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\confuse\chargeable.exeFilesize
107KB
MD515a7892b900f884c9ac14c7cef315059
SHA1a3a32ed4dc7c7bec2d98cf8aa890e129b1d59a1f
SHA25695f691dc5c7122a8253feb3a60b0918126de15b322a8c77bf54b5c1a2798d6d0
SHA51231d2c466f2b1b0a8133f7c047f0a23929d9cd71b000a769f048a6a8df57fab0856f44f7292451de5c7a39ad82466cd8fed8faa11386c45e79ad90732a22fb5ff
-
memory/2412-23-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2412-32-0x0000000000BA0000-0x0000000000BE0000-memory.dmpFilesize
256KB
-
memory/2412-31-0x00000000744C0000-0x0000000074A6B000-memory.dmpFilesize
5.7MB
-
memory/2412-30-0x00000000744C0000-0x0000000074A6B000-memory.dmpFilesize
5.7MB
-
memory/2412-29-0x0000000000BA0000-0x0000000000BE0000-memory.dmpFilesize
256KB
-
memory/2412-28-0x00000000744C0000-0x0000000074A6B000-memory.dmpFilesize
5.7MB
-
memory/2412-27-0x00000000744C0000-0x0000000074A6B000-memory.dmpFilesize
5.7MB
-
memory/2412-26-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2412-20-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2568-19-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/2568-25-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB
-
memory/2568-18-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB
-
memory/2568-17-0x0000000000A20000-0x0000000000A60000-memory.dmpFilesize
256KB
-
memory/2568-16-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB
-
memory/2896-0-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB
-
memory/2896-15-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB
-
memory/2896-2-0x0000000000B90000-0x0000000000BD0000-memory.dmpFilesize
256KB
-
memory/2896-1-0x0000000074A70000-0x000000007501B000-memory.dmpFilesize
5.7MB