netdooka | bd59e50bd956f6ef82d05a2a9f945543cc3c4868a6916f772b6f53d51f804903

General

Target

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
Size

660KB
MD5

54a315b26c66694821fb2091ef865f7f
SHA1

9f79ec5e7845bd33a58124fd3d10637a20630bb5
SHA256

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef
SHA512

625e851ddedd83103d1b27c25bdb8428e8aab9321436d48668112dd887f9ede5655b4f5b13d69e656bae522951c50cedd53426de725788ba5697089e81156814
SSDEEP

12288:nBxT3SKVIC9HdFEtttJl3Mob+60MCV94D0cIegdu1oeK/lGRgOUqmq9kR6lhKXhh:BxT3ZVB9HdFQPl3M06MCV9k0DegduieE

Score

10^/10

netdooka evasion loader persistence rat

Malware Config

Extracted

Family

netdooka

C2

Signatures

NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
loader rat netdooka
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

Processes:

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Avira	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Avira	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

description	pid	process	target process
PID 2880 set thread context of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

Launches sc.exe 7 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2044 sc.exe
2136 sc.exe
1436 sc.exe
2444 sc.exe
3052 sc.exe
2532 sc.exe
2164 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2756 PING.EXE

pid	process
2044	sc.exe
2136	sc.exe
1436	sc.exe
2444	sc.exe
3052	sc.exe
2532	sc.exe
2164	sc.exe

pid	process
2756	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

pid	process
2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe

description	pid	process	target process
PID 2880 wrote to memory of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
PID 2880 wrote to memory of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
PID 2880 wrote to memory of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
PID 2880 wrote to memory of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
PID 2880 wrote to memory of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
PID 2880 wrote to memory of 2712	2880	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
PID 2712 wrote to memory of 2756	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	PING.EXE
PID 2712 wrote to memory of 2756	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	PING.EXE
PID 2712 wrote to memory of 2756	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	PING.EXE
PID 2712 wrote to memory of 2756	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	PING.EXE
PID 2712 wrote to memory of 2552	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	cmd.exe
PID 2712 wrote to memory of 2552	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	cmd.exe
PID 2712 wrote to memory of 2552	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	cmd.exe
PID 2712 wrote to memory of 2552	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	cmd.exe
PID 2712 wrote to memory of 2532	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2532	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2532	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2532	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2164	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2164	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2164	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2164	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2044	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2044	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2044	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2044	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2136	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2136	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2136	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2136	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 1436	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 1436	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 1436	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 1436	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2444	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2444	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2444	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 2444	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 3052	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 3052	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 3052	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe
PID 2712 wrote to memory of 3052	2712	4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880

C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe
"C:\Users\Admin\AppData\Local\Temp\4ceded881995aa09ac269002c4312560ac38576aa82d95dc85d28a1a2b76bbef.exe"
2⤵
- Checks for any installed AV software in registry
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\PING.EXE
"C:\Windows\System32\PING.EXE" 22.61.56.108 -n 4
3⤵
- Runs ping.exe
PID:2756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C copy "" "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe"
3⤵
PID:2552

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create SecureElementDataSrv binpath= "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe delected"
3⤵
- Launches sc.exe
PID:2532

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start SecureElementDataSrv
3⤵
- Launches sc.exe
PID:2164

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" stop SecureElementDataSrv
3⤵
- Launches sc.exe
PID:2044

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start SecureElementDataSrv
3⤵
- Launches sc.exe
PID:2136

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" stop SecureElementDataSrv
3⤵
- Launches sc.exe
PID:1436

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start SecureElementDataSrv
3⤵
- Launches sc.exe
PID:2444

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" stop SecureElementDataSrv
3⤵
- Launches sc.exe
PID:3052

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Software Discovery

1

T1518

Security Software Discovery

1

T1518.001

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2712-40-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2712-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2712-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2712-44-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/2712-53-0x0000000004640000-0x0000000004680000-memory.dmp

Filesize
256KB

Download
memory/2712-51-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2712-47-0x0000000004640000-0x0000000004680000-memory.dmp

Filesize
256KB

Download
memory/2712-46-0x0000000004640000-0x0000000004680000-memory.dmp

Filesize
256KB

Download
memory/2712-45-0x00000000749A0000-0x000000007508E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-29-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/2880-24-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/2880-8-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/2880-7-0x0000000000880000-0x0000000000881000-memory.dmp

Filesize
4KB

Download
memory/2880-6-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2880-5-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/2880-2-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2880-19-0x0000000002220000-0x0000000002221000-memory.dmp

Filesize
4KB

Download
memory/2880-35-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/2880-34-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/2880-33-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/2880-32-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/2880-31-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/2880-30-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2880-10-0x00000000032B0000-0x00000000032B1000-memory.dmp

Filesize
4KB

Download
memory/2880-28-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2880-27-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/2880-26-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/2880-25-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2880-9-0x00000000031B0000-0x00000000031B2000-memory.dmp

Filesize
8KB

Download
memory/2880-23-0x0000000003230000-0x0000000003231000-memory.dmp

Filesize
4KB

Download
memory/2880-22-0x0000000003240000-0x0000000003241000-memory.dmp

Filesize
4KB

Download
memory/2880-21-0x0000000003210000-0x0000000003211000-memory.dmp

Filesize
4KB

Download
memory/2880-36-0x0000000003260000-0x0000000003261000-memory.dmp

Filesize
4KB

Download
memory/2880-20-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2880-18-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/2880-17-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/2880-16-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/2880-11-0x0000000003200000-0x0000000003201000-memory.dmp

Filesize
4KB

Download
memory/2880-4-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/2880-3-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2880-15-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2880-14-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2880-13-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/2880-12-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2880-38-0x000000000AC20000-0x000000000AD51000-memory.dmp

Filesize
1.2MB

Download
memory/2880-48-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-49-0x0000000000360000-0x00000000003C0000-memory.dmp

Filesize
384KB

Download
memory/2880-0-0x0000000000400000-0x0000000000531000-memory.dmp

Filesize
1.2MB

Download
memory/2880-1-0x0000000000360000-0x00000000003C0000-memory.dmp

Filesize
384KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads