General
-
Target
89912dd9337d249975a0f7c176f73742bfd76eb1b49ee729afc6bcdd23392a2c
-
Size
104KB
-
Sample
240419-3yv6waag92
-
MD5
f3e7e24a97683ec7edaf072c3a79ba19
-
SHA1
10b3bafa4d092f8e268bc304fdf55240ed085962
-
SHA256
89912dd9337d249975a0f7c176f73742bfd76eb1b49ee729afc6bcdd23392a2c
-
SHA512
6b36653fc63d353239827efa5050e5c88c097bc1cdce55b7a3ccad2f79f7a4a83857798a0623b50dd38cbc99eec9448d88ad7421e3ed428ee6a0fa9b54e2f95b
-
SSDEEP
1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegL:w5eznsjsguGDFqGx8egL
Static task
static1
Behavioral task
behavioral1
Sample
89912dd9337d249975a0f7c176f73742bfd76eb1b49ee729afc6bcdd23392a2c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
89912dd9337d249975a0f7c176f73742bfd76eb1b49ee729afc6bcdd23392a2c.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Targets
-
-
Target
89912dd9337d249975a0f7c176f73742bfd76eb1b49ee729afc6bcdd23392a2c
-
Size
104KB
-
MD5
f3e7e24a97683ec7edaf072c3a79ba19
-
SHA1
10b3bafa4d092f8e268bc304fdf55240ed085962
-
SHA256
89912dd9337d249975a0f7c176f73742bfd76eb1b49ee729afc6bcdd23392a2c
-
SHA512
6b36653fc63d353239827efa5050e5c88c097bc1cdce55b7a3ccad2f79f7a4a83857798a0623b50dd38cbc99eec9448d88ad7421e3ed428ee6a0fa9b54e2f95b
-
SSDEEP
1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegL:w5eznsjsguGDFqGx8egL
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1