Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 23:41
Static task
static1
Behavioral task
behavioral1
Sample
207A0A0F98F554F4B8CE5715F07514C6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
207A0A0F98F554F4B8CE5715F07514C6.exe
Resource
win10v2004-20240412-en
General
-
Target
207A0A0F98F554F4B8CE5715F07514C6.exe
-
Size
113KB
-
MD5
207a0a0f98f554f4b8ce5715f07514c6
-
SHA1
693f287b916c2376573aeff102827961ee1352f4
-
SHA256
7f9690a0ca91cfd371100be8d22540405315508650093ab356570bf236abe0ed
-
SHA512
a7607294b616d99fc4f345bbcf0c038d0aeae3d207a340adccc0c20022168d71fe9e55fe3f2b0d9d8f6b00242f7995333761df3a47951ec124c9de501ca8a243
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiaH:P5eznsjsguGDFqGZ2rZ
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4620 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
207A0A0F98F554F4B8CE5715F07514C6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation 207A0A0F98F554F4B8CE5715F07514C6.exe -
Executes dropped EXE 2 IoCs
Processes:
chargeable.exechargeable.exepid process 4536 chargeable.exe 3768 chargeable.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
207A0A0F98F554F4B8CE5715F07514C6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 207A0A0F98F554F4B8CE5715F07514C6.exe Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\207A0A0F98F554F4B8CE5715F07514C6.exe" 207A0A0F98F554F4B8CE5715F07514C6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chargeable.exedescription pid process target process PID 4536 set thread context of 3768 4536 chargeable.exe chargeable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
chargeable.exedescription pid process Token: SeDebugPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe Token: 33 3768 chargeable.exe Token: SeIncBasePriorityPrivilege 3768 chargeable.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
207A0A0F98F554F4B8CE5715F07514C6.exechargeable.exechargeable.exedescription pid process target process PID 3252 wrote to memory of 4536 3252 207A0A0F98F554F4B8CE5715F07514C6.exe chargeable.exe PID 3252 wrote to memory of 4536 3252 207A0A0F98F554F4B8CE5715F07514C6.exe chargeable.exe PID 3252 wrote to memory of 4536 3252 207A0A0F98F554F4B8CE5715F07514C6.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 4536 wrote to memory of 3768 4536 chargeable.exe chargeable.exe PID 3768 wrote to memory of 4620 3768 chargeable.exe netsh.exe PID 3768 wrote to memory of 4620 3768 chargeable.exe netsh.exe PID 3768 wrote to memory of 4620 3768 chargeable.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\207A0A0F98F554F4B8CE5715F07514C6.exe"C:\Users\Admin\AppData\Local\Temp\207A0A0F98F554F4B8CE5715F07514C6.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.logFilesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeFilesize
113KB
MD5de66964529c518c15474179e39c85840
SHA1464efdabd2a3c66b79b5105f4b964f25ae88dede
SHA256a4657a5437543e044d96d1d1427c49c031c821a4bcf34229c178443f42fd0ace
SHA51281d337777a3dabe996832c989acf92ae62072ba2920110265bea4406d12d3742f80df8ef8d42a95f6e1ed16bd3d3ed83fcf7188fe72dc3d2473b7b96490142ad
-
memory/3252-0-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3252-1-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3252-2-0x0000000001660000-0x0000000001670000-memory.dmpFilesize
64KB
-
memory/3252-17-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3768-21-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/3768-25-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3768-27-0x0000000001500000-0x0000000001510000-memory.dmpFilesize
64KB
-
memory/3768-28-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3768-29-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/3768-30-0x0000000001500000-0x0000000001510000-memory.dmpFilesize
64KB
-
memory/4536-20-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/4536-19-0x0000000000E80000-0x0000000000E90000-memory.dmpFilesize
64KB
-
memory/4536-18-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB
-
memory/4536-26-0x0000000075350000-0x0000000075901000-memory.dmpFilesize
5.7MB