Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-11-2024 20:50
Static task
static1
Behavioral task
behavioral1
Sample
de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe
Resource
win10v2004-20241007-en
General
-
Target
de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe
-
Size
113KB
-
MD5
4a2a45fc248cfab87d9f10b39f2c3aa0
-
SHA1
fc73fd8132452cc78056ec42d45fce47e4038e61
-
SHA256
de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62f
-
SHA512
ef8fb5de5bd4f9054032adf4aeaa83144a1dec459759bba078b1a5ad08eca98621f96239f22455cc76f305d09805b3ba696165ecbe39bc962713c45fc457e94f
-
SSDEEP
1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73Rn:w5eznsjsguGDFqGx8egoxmO3rRn
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3000 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 536 chargeable.exe 2832 chargeable.exe -
Loads dropped DLL 2 IoCs
pid Process 2376 de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe 2376 de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe" de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 536 set thread context of 2832 536 chargeable.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe Token: 33 2832 chargeable.exe Token: SeIncBasePriorityPrivilege 2832 chargeable.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2376 wrote to memory of 536 2376 de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe 31 PID 2376 wrote to memory of 536 2376 de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe 31 PID 2376 wrote to memory of 536 2376 de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe 31 PID 2376 wrote to memory of 536 2376 de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe 31 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 536 wrote to memory of 2832 536 chargeable.exe 32 PID 2832 wrote to memory of 3000 2832 chargeable.exe 33 PID 2832 wrote to memory of 3000 2832 chargeable.exe 33 PID 2832 wrote to memory of 3000 2832 chargeable.exe 33 PID 2832 wrote to memory of 3000 2832 chargeable.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe"C:\Users\Admin\AppData\Local\Temp\de7ba0f8b28acfe56cf78d7f43fe79ea3732ae90576f509a05887514ff43b62fN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3000
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD54130316a78aecbd8ba2ccc91066aa11e
SHA1d92865696e82667cb0793a5cd57d0d8da4afb69e
SHA25661ab0295fcc4d124929f35e63505308e98eb6dfa8a7ff3a23e37f2439c047ec4
SHA51224a47ebf9f796edc75566311d5f31c6c4c30c9ce01b7a73f207d058cd6c82e9b88341f70aa3a8a1ec2b7d7546ee719266a2ebcebd10704adb111ba963b3559ae