Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 20:58
Static task
static1
Behavioral task
behavioral1
Sample
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe
Resource
win10v2004-20240802-en
General
-
Target
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe
-
Size
115KB
-
MD5
b041bb8145f8237186aeee76a6bc8fc0
-
SHA1
b1e230ade2a9f0fc4be95a544b42e6a6e16c5814
-
SHA256
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c
-
SHA512
16009c2fd22508b46caedd7a98282304c1fed084556e8fd18869b48edf38f589546d5d5a5a7faeaba57a31111730b7d3ea9d7651aabfbc547e18e7f830fcc8d4
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMCh:P5eznsjsguGDFqGZ2rCh
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2748 netsh.exe -
Executes dropped EXE 2 IoCs
Processes:
chargeable.exechargeable.exepid process 2488 chargeable.exe 2716 chargeable.exe -
Loads dropped DLL 2 IoCs
Processes:
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exepid process 2524 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe 2524 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe" 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chargeable.exedescription pid process target process PID 2488 set thread context of 2716 2488 chargeable.exe chargeable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
chargeable.exenetsh.exe42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exechargeable.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
chargeable.exedescription pid process Token: SeDebugPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe Token: 33 2716 chargeable.exe Token: SeIncBasePriorityPrivilege 2716 chargeable.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exechargeable.exechargeable.exedescription pid process target process PID 2524 wrote to memory of 2488 2524 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe chargeable.exe PID 2524 wrote to memory of 2488 2524 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe chargeable.exe PID 2524 wrote to memory of 2488 2524 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe chargeable.exe PID 2524 wrote to memory of 2488 2524 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2488 wrote to memory of 2716 2488 chargeable.exe chargeable.exe PID 2716 wrote to memory of 2748 2716 chargeable.exe netsh.exe PID 2716 wrote to memory of 2748 2716 chargeable.exe netsh.exe PID 2716 wrote to memory of 2748 2716 chargeable.exe netsh.exe PID 2716 wrote to memory of 2748 2716 chargeable.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe"C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2748
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51fc0bb6dbee5fc44ec520d6dfe3de76f
SHA1c5bb46513add925d3266ad61d81735339e41a250
SHA2564fbad26fbec956fe49f6f239e3fd59201d92822d6e8f4a8f6ec8ac6c6c57d291
SHA512fcc5acd50c8d69bb78b24641a3e295cc50ea354ce7d2bf59786028212fad56109bab29020148b3c816e28eb07e9c35b06e0bff3a7d36d6b80d1f9e88ac0547b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5967b73744368509922f26418fe200a20
SHA17563016019b694bbdc015f71d2c337f6f5f649c2
SHA25677e5e5cdb30b30585e3f60b4ae2594bf8b9f3b982e1eca6661dd2d9ac76cde83
SHA5120c3d60396a2a8979adcb046414ea21578cded6edd1c9d0c4b27aba6f9d29eb50b1f6194ea1508c679864b43fbdb4d5029b25d1c852f2078a957f9d6cd4c07648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5377cee510ca9b2f04d5253c7a420dc6c
SHA14bd4f2d5d1234c1fd5cfdbeddf33472e666c65e5
SHA25656e36e51a445adc33d397eb0bbf86c4242b377afd633f5d3d5ea8aa898353cd0
SHA51221b2397b0d8a2e3c7da787bfe6918cc4ed18c493717fb9d8e451abd53848aa79484435e745211095ad697cc63fee680f1796040d983f7c34a3ca02fa160676ec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
115KB
MD55ec5c44867f3fc4e154c915e111a133e
SHA15c542cb010c8eac66b15ed8510bf400dc7541e77
SHA2569b194921c9d4811bba52a7278c034fb8981d440afb85c53132c2343780a72ff2
SHA512a40ad3053195a69819b2e9c7bb00b36f544096e09867e7b794b15a01892ca2a7557e7b87c307f0aa13142c823db9f9025f49c933e2a01da4d3d493dc8ec28313