Analysis

  • max time kernel
    101s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 05:15

General

  • Target

    603029651e4069dd134008902983c360N.exe

  • Size

    114KB

  • MD5

    603029651e4069dd134008902983c360

  • SHA1

    f3208df5baf88764b1398c576da36155708453cb

  • SHA256

    aa6814fc37879b6a828fcd3d44eec380b4b1cf392902d2a29e74062f07f5e45b

  • SHA512

    2d398cf820b380db9aadf91d023fed6aecb766eb95373475125f8b4148a88c687bc0191fd5b7812342eb28b78fc627cabc1ff0528fb092454a55c79c0870208c

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDJ:P5eznsjsguGDFqGZ2rDJ

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\603029651e4069dd134008902983c360N.exe
    "C:\Users\Admin\AppData\Local\Temp\603029651e4069dd134008902983c360N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
      "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
        C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
        3⤵
        • Executes dropped EXE
        PID:1588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 152
          4⤵
          • Program crash
          PID:3840
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1588 -ip 1588
    1⤵
      PID:788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe

      Filesize

      114KB

      MD5

      5f3b03ed9980db22ac726a54fd577bea

      SHA1

      6b6f0912997c14f46d58026c887d35761a842b72

      SHA256

      d1e5934f534ffe3bb8657ef9033216642f995a585f69f7b680c9fe453a7484f4

      SHA512

      cb2bbe4762a9aef83f018580a3284d1ffec9db488312f20d57a79d7a06e2f4d46864a97841b3e8b46d29d02da3e92c48c613f72f208e9cf45c2152fdd7bdd825

    • memory/1588-21-0x0000000000400000-0x000000000040C000-memory.dmp

      Filesize

      48KB

    • memory/1780-0-0x0000000074C32000-0x0000000074C33000-memory.dmp

      Filesize

      4KB

    • memory/1780-1-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB

    • memory/1780-2-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB

    • memory/1780-17-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB

    • memory/2520-18-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB

    • memory/2520-19-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB

    • memory/2520-20-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB

    • memory/2520-24-0x0000000074C30000-0x00000000751E1000-memory.dmp

      Filesize

      5.7MB