General
-
Target
de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902
-
Size
117KB
-
Sample
240801-f4rdjstgkr
-
MD5
b55cef0497761d472c65d984d79a859e
-
SHA1
6ac3b5e313312e372eb8362d93b88e7628a7ff1d
-
SHA256
de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902
-
SHA512
02b9d51acbde8f0ed6ea0432849b25b7a15a4ab5cfd59a8f4a1ed67616b478910a6bb819c393c008d12fbaac52861a289aa96ce2c90b38364f449de8af79b6d7
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLZl+Z:P5eznsjsguGDFqGZ2rDLOZ
Static task
static1
Behavioral task
behavioral1
Sample
de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902.exe
Resource
win10v2004-20240730-en
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Targets
-
-
Target
de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902
-
Size
117KB
-
MD5
b55cef0497761d472c65d984d79a859e
-
SHA1
6ac3b5e313312e372eb8362d93b88e7628a7ff1d
-
SHA256
de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902
-
SHA512
02b9d51acbde8f0ed6ea0432849b25b7a15a4ab5cfd59a8f4a1ed67616b478910a6bb819c393c008d12fbaac52861a289aa96ce2c90b38364f449de8af79b6d7
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLZl+Z:P5eznsjsguGDFqGZ2rDLOZ
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1