Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 13:13
Static task
static1
Behavioral task
behavioral1
Sample
5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe
Resource
win10v2004-20241007-en
General
-
Target
5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe
-
Size
119KB
-
MD5
b3d02d9163f80063ca0cdabc9787d750
-
SHA1
f98ad95d0bf597b9d049c2b1acec2a683aa12136
-
SHA256
5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5ac
-
SHA512
1dce4e3da371d605466fbf0c76d2ca54dd74e6f88455821f0ead41b508cb3ef85530b279072b28b058cb4c78051d7ac0071d18b272c342c4d0f69248209f676b
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDL14FgOP:P5eznsjsguGDFqGZ2rDL14Fge
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2916 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 1964 chargeable.exe 2392 chargeable.exe 580 chargeable.exe 1044 chargeable.exe -
Loads dropped DLL 2 IoCs
pid Process 2236 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe 2236 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe" 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1964 set thread context of 580 1964 chargeable.exe 34 PID 1964 set thread context of 2392 1964 chargeable.exe 33 PID 1964 set thread context of 1044 1964 chargeable.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe Token: 33 580 chargeable.exe Token: SeIncBasePriorityPrivilege 580 chargeable.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1964 2236 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe 31 PID 2236 wrote to memory of 1964 2236 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe 31 PID 2236 wrote to memory of 1964 2236 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe 31 PID 2236 wrote to memory of 1964 2236 5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe 31 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 580 1964 chargeable.exe 34 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 2392 1964 chargeable.exe 33 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 1964 wrote to memory of 1044 1964 chargeable.exe 32 PID 580 wrote to memory of 2916 580 chargeable.exe 35 PID 580 wrote to memory of 2916 580 chargeable.exe 35 PID 580 wrote to memory of 2916 580 chargeable.exe 35 PID 580 wrote to memory of 2916 580 chargeable.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe"C:\Users\Admin\AppData\Local\Temp\5fcad70659361b7c5d65802477203f585efe08fcd46b154e043d3682cba2e5acN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
PID:1044
-
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
PID:2392
-
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2916
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f0cf5b1794eca7cd73f9c020daab8ef2
SHA1cd040b212f8cd90e629e7acefd14972b68e575ea
SHA2562af00edce7ef3266897e52dc81e8de3b7a079028c0f1f96eaff9e38ad342f617
SHA51255c9f22bc101c986b2e83f31e20415031fbf1fbfedd33907487de75069c43c5cfe3ba243025de6b66405925ba506f66d19d9da69af187f499143bc2da71341de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE
Filesize264B
MD58a33d61fcb9569a1267d28fafc6a9597
SHA119143978d2af727f4d2e1a3464cebb482f257afc
SHA256deaad3e710b78e4781e4c203b45a686d929d92a2740adb660ce53cf306c7d817
SHA51272c64fd00a600b906a6a59fd15ef33d3cc15c05219fbc42eb81bf1bff7ffd2591cad46634f9b5196c968e21ea2b4d3b3beda39189f7917f2cace63a2b415bb9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b9cab5104785331f1e066b21b8769a7
SHA1164ff01b4010b45b5ae0d6bf221962d9d8ee250d
SHA2566e853eb20692e11f66fca4516179c67e055d7eaac78aa20f109f8a4e6d1fc4ae
SHA512307766e10e59bab5cc57f964f6c537697caa6069111bf0ab5e3e5be05f9f1051bb4805f820ae79f5a5575b0a7cd5716c5ff5bb2a294a205b7c03509b948cd706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5713e08b18147f5aa3d7de8d64192e79f
SHA1ecf765c3cddefe2d1be008d338f1e68fbd5fa1b9
SHA256321817659bef8423b4aac18e1450b8d3dd877b78a199532918f0f9b5d8ac78c0
SHA5125b6e74e36ee77ed0dee6621a78e15acb080b221f468d1500affa9a9c5f84267a8626c4a84d0a53e5790d8f82f08f0f4df1f03c38c7d867e239df5ca307fce022
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521e8e8703a8c7a96403eb6b5045b3650
SHA17c173f433d08914b0dca93a487d05c5870f7186a
SHA2568d138abc11b200dcbd8b2011127037406db96f0b1b9ab1744472c236319f29ba
SHA5120a9a52093d53b2a68a9ea2de564f2eaf33ffc9185bfb653c72eb20c8f3ddbf38fede6e487506dab9e60a3f4f2f35129aae6b139067cbe566871f616a503e6623
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
119KB
MD58fcdb92503829c3994545a6a5b6c31a7
SHA1a82331bd40c5d0a5b0a365c8d50aae13303daed8
SHA2568f743967f18f20063b3cca2d0a81a494eb660616fabce9d808bd4ff888c7e7c2
SHA512a0d44c2740449a6d8a7ee92190b8c7f43fd4a69eeabc9f923b3bda71039d298050db3121e09b7a61f2f7c53229bd29e8fde1a5bf3c40a83565931f235fe111c4