Malware Analysis Report

2024-08-06 19:42

Sample ID 240619-b7fc8swcqm
Target da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe
SHA256 da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f
Tags
njrat neuf evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f

Threat Level: Known bad

The file da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe was found to be: Known bad.

Malicious Activity Summary

njrat neuf evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Netsh Helper DLL
T1546.007
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Event Triggered Execution
T1546
Netsh Helper DLL
T1546.007
Defense Evasion
TA0005
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-19 01:46

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-19 01:46

Reported

2024-06-19 01:49

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe" C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1748 set thread context of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3772 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3772 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3772 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1748 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 5024 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 5024 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 5024 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe

"C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
US 8.8.8.8:53 doddyfire.linkpc.net udp

Files

memory/3772-0-0x00000000745F2000-0x00000000745F3000-memory.dmp

memory/3772-1-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/3772-2-0x00000000745F0000-0x0000000074BA1000-memory.dmp

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5 36464e4939b58817725294b4b0cabdb1
SHA1 cebd95167ed31943044127925687a357a1bb5565
SHA256 fffeaa9c4406820492ca41862c21c077fc393f6748ee88ee10da30ede63f8cb4
SHA512 42cf8039dd839560df0d8e96f05f65fd8bbd9a13399b9a59375861b1b11980b90341015e7f37ddde9ff7e6cadb60f8ae6bf329be9c86e827ea3caf3e0208bd43

memory/3772-17-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/1748-18-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/1748-19-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/5024-20-0x0000000000400000-0x000000000040C000-memory.dmp

memory/5024-23-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/1748-24-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/5024-25-0x00000000745F0000-0x0000000074BA1000-memory.dmp

memory/5024-26-0x00000000745F0000-0x0000000074BA1000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-19 01:46

Reported

2024-06-19 01:49

Platform

win7-20240611-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe" C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1344 set thread context of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2100 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2100 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2100 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2100 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1344 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2040 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 2040 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 2040 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 2040 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe

"C:\Users\Admin\AppData\Local\Temp\da2a01e2b4e3d5b2e56d43427636e9c0a20157b1369234c91087a0083e986d3f.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 doddyfire.linkpc.net udp
MA 160.177.58.73:10000 doddyfire.linkpc.net tcp

Files

memory/2100-0-0x0000000074411000-0x0000000074412000-memory.dmp

memory/2100-1-0x0000000074410000-0x00000000749BB000-memory.dmp

memory/2100-2-0x0000000074410000-0x00000000749BB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab601C.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar604E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2c5dac599a09f4c906965eab1a7576f
SHA1 e1351efe31fd436a6cd77941aaeb357e2383f8d5
SHA256 11faa450747a105f8f1e41d370adf5df3604cbca63b2fbfec1d3951e7008822e
SHA512 d833048b70040511b80c94a908a6b3046abd43c72a46aa9a5e89ef1f7094ead79bbe47a3da5acf43ed0e8a1f2afee511e5ab88321ca6b3e0df1ad9e0cbece7fa

\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5 51836fe0bbb4f36daf09a3be2d3d8f9d
SHA1 7e6ea36f44fbb5c82beca0fdb402cf751e106dda
SHA256 28bbcfd70d175a3223d03904d3f5cd810072ac1432ac1ef2cdb86d1319326e4f
SHA512 0582960bb8a5dceeeba228d04b934106b5bf1a9d1ae6525735534980ec68bbbf76ff9da2d38a1ecf3937b530a8b294e3405512d3a49e60ac3bb1d8c6ffc5bcec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d602810875e7a01d21f98aca7b1ce1f2
SHA1 099253c1c5bc6bd3cab49cd64c39ef39e7efe9be
SHA256 2cbbcf8ac4d5456269fe01f4eaacd2537d8929cc57762387cb9a3279ee9452a3
SHA512 a7bd28b0217aefd8e4ca622c4713ba4be5f597cdb0bd5344565c6d09c18fda9a2889f62808c99a65c4638bba378d275a05af8e5f68e7f367b69f493dc9f3baf5

memory/2100-185-0x0000000074410000-0x00000000749BB000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ff34b26c8b176c2e1129a7831e87b4e7
SHA1 bce9a5b35f84bbdeeea385d02c8e570e61ccda27
SHA256 fc972ed32a986ae88c28e0d2e659544c42db8e310c5f237c0660fa96d7dd3ead
SHA512 76da2dc0da64ca47e28e8616ccbe4a29305645905fb4adab023be5c93250d2f6e7fe84e40e192af5d2ecaa8578e752ed0cafe0138b86b75e71dbc4f38c23e1f0

memory/2040-341-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2040-344-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2040-343-0x0000000000400000-0x000000000040C000-memory.dmp