Malware Analysis Report

2024-10-19 08:03

Sample ID 240810-zsf8zsxglp
Target 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c
SHA256 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c
Tags
njrat neuf discovery evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c

Threat Level: Known bad

The file 42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c was found to be: Known bad.

Malicious Activity Summary

njrat neuf discovery evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-10 20:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-10 20:58

Reported

2024-08-10 21:01

Platform

win7-20240729-en

Max time kernel

144s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe" C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2488 set thread context of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2524 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2524 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2524 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2524 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2488 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 2716 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 2716 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 2716 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 2716 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe

"C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 doddyfire.linkpc.net udp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 doddyfire.linkpc.net udp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp

Files

memory/2524-0-0x00000000748E1000-0x00000000748E2000-memory.dmp

memory/2524-1-0x00000000748E0000-0x0000000074E8B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab8BED.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar8C1E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fc0bb6dbee5fc44ec520d6dfe3de76f
SHA1 c5bb46513add925d3266ad61d81735339e41a250
SHA256 4fbad26fbec956fe49f6f239e3fd59201d92822d6e8f4a8f6ec8ac6c6c57d291
SHA512 fcc5acd50c8d69bb78b24641a3e295cc50ea354ce7d2bf59786028212fad56109bab29020148b3c816e28eb07e9c35b06e0bff3a7d36d6b80d1f9e88ac0547b9

\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5 5ec5c44867f3fc4e154c915e111a133e
SHA1 5c542cb010c8eac66b15ed8510bf400dc7541e77
SHA256 9b194921c9d4811bba52a7278c034fb8981d440afb85c53132c2343780a72ff2
SHA512 a40ad3053195a69819b2e9c7bb00b36f544096e09867e7b794b15a01892ca2a7557e7b87c307f0aa13142c823db9f9025f49c933e2a01da4d3d493dc8ec28313

memory/2524-176-0x00000000748E0000-0x0000000074E8B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 967b73744368509922f26418fe200a20
SHA1 7563016019b694bbdc015f71d2c337f6f5f649c2
SHA256 77e5e5cdb30b30585e3f60b4ae2594bf8b9f3b982e1eca6661dd2d9ac76cde83
SHA512 0c3d60396a2a8979adcb046414ea21578cded6edd1c9d0c4b27aba6f9d29eb50b1f6194ea1508c679864b43fbdb4d5029b25d1c852f2078a957f9d6cd4c07648

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 377cee510ca9b2f04d5253c7a420dc6c
SHA1 4bd4f2d5d1234c1fd5cfdbeddf33472e666c65e5
SHA256 56e36e51a445adc33d397eb0bbf86c4242b377afd633f5d3d5ea8aa898353cd0
SHA512 21b2397b0d8a2e3c7da787bfe6918cc4ed18c493717fb9d8e451abd53848aa79484435e745211095ad697cc63fee680f1796040d983f7c34a3ca02fa160676ec

memory/2716-340-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2716-343-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2716-342-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-10 20:58

Reported

2024-08-10 21:01

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe" C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1964 set thread context of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1260 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1260 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1260 wrote to memory of 1964 N/A C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 1964 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
PID 3172 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 3172 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe
PID 3172 wrote to memory of 684 N/A C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe

"C:\Users\Admin\AppData\Local\Temp\42d82cbdcca10ece04b362230375a514cee3bd67235be102ccce95eef2be4d1c.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 doddyfire.linkpc.net udp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp
MA 105.155.165.255:10000 doddyfire.linkpc.net tcp

Files

memory/1260-0-0x0000000074AC2000-0x0000000074AC3000-memory.dmp

memory/1260-1-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/1260-2-0x0000000074AC0000-0x0000000075071000-memory.dmp

C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

MD5 05d1106977791b804003472d4a7d5f92
SHA1 bf81d16eaa3cfd845986f25d1c78fc3d0640663f
SHA256 6d1d12c3cb00a660d9c4e300a40fe60df289c500647410d249f01534cae04a8b
SHA512 f37aafc552c6c1324fcdb3c37cd562576bb4ed6bf0d91f0df84be0d3a5b90adf78763bceb690c0c15ea382cbe1610ab7124fb1b5e57cc6e6569ce6cb551e4e5c

memory/1964-18-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/1260-17-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/1964-19-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/3172-20-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3172-23-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/3172-24-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/3172-26-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/1964-25-0x0000000074AC0000-0x0000000075071000-memory.dmp

memory/3172-27-0x0000000074AC0000-0x0000000075071000-memory.dmp