Malware Analysis Report

2024-10-19 08:03

Sample ID 240806-cvr2yawgqm
Target ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe
SHA256 ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4
Tags
njrat neuf discovery evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4

Threat Level: Known bad

The file ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe was found to be: Known bad.

Malicious Activity Summary

njrat neuf discovery evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-06 02:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-06 02:24

Reported

2024-08-06 02:26

Platform

win7-20240705-en

Max time kernel

146s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe" C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1872 set thread context of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2452 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2452 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2452 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2452 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1872 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1636 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 1636 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 1636 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 1636 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe

"C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp
US 8.8.8.8:53 doddyfire.linkpc.net udp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp

Files

memory/2452-0-0x0000000074C21000-0x0000000074C22000-memory.dmp

memory/2452-1-0x0000000074C20000-0x00000000751CB000-memory.dmp

memory/2452-2-0x0000000074C20000-0x00000000751CB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabD645.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarD667.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cf06b720e644ab0a1878b694b388dd2c
SHA1 70cdb0174a6d0a8c041ac9d2095a628349ea0c87
SHA256 b7bfc01eec40c6fb369ed4734bcb1b9eb955ef62dd58231264ce6c8f864bb0c2
SHA512 c497c68da9c4c608cbfc2f21bc4feb09b68a6009636cee0745f79af7aec0d7999cbbbf2d5b4c04ef5d5bbf4ff07a5910f4e53dc274beba98b2375c622872ac9d

\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5 29724b6f50b9dc09dd035e4d49dd72a1
SHA1 8b4aa7ed57b807b190e93cdf0465d86723b6aa20
SHA256 475f7840a7f6c39c7e3ae3326e123f88440b0393213c6ad122f3ef92755414aa
SHA512 dfd43896af9fe86abfef37ad5a77831d6a204346c5c109d053d5af496e58d5571e3ca2f0c462e21c8b97b11eb557a624528076a4589b366439873035d5070496

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f8c1f3d8c14fa28c287bdba3ec85ff40
SHA1 33f2ab94d9b5a74981be4dd0865413e3e5040f3f
SHA256 88d70bbeebce132f20d065530e81327b82ae0d0403304d7c729b09ca1866b92a
SHA512 7706f71464f3c91a895265a5e3ebe7e9a736c36191f005db9b22ac63dd45bc277fa82125133f31c83303e33efe9e1c91af12dab6e1ddb1fbdc856d0e6bcc832f

memory/2452-191-0x0000000074C20000-0x00000000751CB000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE

MD5 e7122c733f9e37bba0ca4c985ce11d6d
SHA1 d661aa5b31ff7ef2df9bc4095279058c36499af2
SHA256 acc9932453f5aa68f4b95986668f5584f99e55bbe02eefc0d0960dab376df81a
SHA512 84cddf68a46f455b4ebbb8c0c70607fe60796cfc5eabdace12d0684a1323af9681700acbdbdc37e63d7806d0220fce9cba5213bb35cee056f9d71646f98711b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE

MD5 a301a2fbd9c7a50520a0e67009c7e8de
SHA1 b720bd804e4b7f5eac976baa3a1a40976bf47b81
SHA256 efcf6322e44eaeebde4ddf6c8f3334148c3a1302d4061319745ce2d74158b3ed
SHA512 0dee9e9e7f5a72d5cba524ad6e0fc07b056706e7f7455fa22c0a606ef3c14ec7494b271de2a515d784a5dd83f338ee5904c4439002c7708fa50221df918c6d72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 63327f1093bc52b66624d196df399e7d
SHA1 f0f7a8459255e6779454f9cf0e3b2191299c2735
SHA256 1d85bdc25962852e484f36694cce6c47575eb93f438286b0936833a99f7bdd1f
SHA512 521558804910074407668dd3dbbe21e019c16027dbc7b3ba2f220fe7718513e034b1a7ce8a566248cdb997a93b8ec76a076cba32edbf647a0ffcad71eb41bd84

memory/1636-342-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1636-345-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1636-344-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-06 02:24

Reported

2024-08-06 02:26

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe" C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3036 set thread context of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3500 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3500 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3500 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3036 wrote to memory of 3116 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3116 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 3116 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 3116 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe

"C:\Users\Admin\AppData\Local\Temp\ca556149fa9f0ba30343e099d1d852bcf3eba68c718482c8b8f209b8cf72efb4.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 35.58.20.217.in-addr.arpa udp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp
DE 188.46.206.74:10000 doddyfire.linkpc.net tcp

Files

memory/3500-0-0x0000000074802000-0x0000000074803000-memory.dmp

memory/3500-1-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3500-2-0x0000000074800000-0x0000000074DB1000-memory.dmp

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5 27af584f0a85c6f7e34e790b62a380d7
SHA1 ef0a9f4a83dde53a4243a8919fc4d2e2239646e8
SHA256 961e1980ef10397e2ef92ca3004e1847e47284528c916efc6da95ad9b096b247
SHA512 c85cdf0da130b590b92152bc1f5eb5a47bdce9c8dbcc540d54fad5f00a8bf0ba72bceed91a9af87e48d48697860fec8ff4b5ee70ae7a8acdb2d7521285fa0aa5

memory/3036-18-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3500-17-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3036-19-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3116-20-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chargeable.exe.log

MD5 0a9b4592cd49c3c21f6767c2dabda92f
SHA1 f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256 c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA512 6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

memory/3036-24-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3116-25-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3116-26-0x0000000074800000-0x0000000074DB1000-memory.dmp

memory/3116-27-0x0000000074800000-0x0000000074DB1000-memory.dmp