netdooka | 531f6cb76127ead379d0315a7ef1a3fc61d8fff1582aa6e4f77cc73259b3e1f2

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe
Size

44KB
MD5

6760dd5d71565ac0cd4cbafcfcea5ff1
SHA1

384d6268d8c62bb1273493dc5a57185680b55739
SHA256

531f6cb76127ead379d0315a7ef1a3fc61d8fff1582aa6e4f77cc73259b3e1f2
SHA512

4779383cb099bc1ae96461b6b07001dc3efd198695f15eaa87705c1c6c94baf89b00b29f892164d2db77d3185c11ef4378a09aca36b4c4f504e6b82f3a017c8f
SSDEEP

768:ySuMLCCb8qs0z3NbVR1ZWTO1Wi+Ys46Aj4z9N9G8Iug3r0PggzQp7j5ALyspH:sMlbXzdz2TahTs4a9Nw8acgGKj5NsJ

Score

10^/10

netdooka discovery evasion execution loader persistence rat

Malware Config

Extracted

Family

netdooka

http://93.115.21.45/gtaddress

Signatures

NetDooka
NetDooka is a malware framework distributed by way of a pay-per-install and written in C#.
loader rat netdooka
Netdooka family
netdooka
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2764	interlock_storage_8_57.exe
1252	min_id_resolver.exe
848	min_id_resolver.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Avira	interlock_storage_8_57.exe
Key opened	\REGISTRY\MACHINE\Software\Wow6432Node\Avira	interlock_storage_8_57.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1000	sc.exe
1580	sc.exe
2956	sc.exe
1004	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	min_id_resolver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	interlock_storage_8_57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	min_id_resolver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2720	ping.exe
2644	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2720	ping.exe
2644	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1252	min_id_resolver.exe
Token: SeDebugPrivilege	848	min_id_resolver.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2720	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	31
PID 2408 wrote to memory of 2720	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	31
PID 2408 wrote to memory of 2720	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	31
PID 2408 wrote to memory of 2764	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	33
PID 2408 wrote to memory of 2764	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	33
PID 2408 wrote to memory of 2764	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	33
PID 2408 wrote to memory of 2764	2408	531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe	33
PID 2764 wrote to memory of 2644	2764	interlock_storage_8_57.exe	34
PID 2764 wrote to memory of 2644	2764	interlock_storage_8_57.exe	34
PID 2764 wrote to memory of 2644	2764	interlock_storage_8_57.exe	34
PID 2764 wrote to memory of 2644	2764	interlock_storage_8_57.exe	34
PID 2764 wrote to memory of 2668	2764	interlock_storage_8_57.exe	36
PID 2764 wrote to memory of 2668	2764	interlock_storage_8_57.exe	36
PID 2764 wrote to memory of 2668	2764	interlock_storage_8_57.exe	36
PID 2764 wrote to memory of 2668	2764	interlock_storage_8_57.exe	36
PID 2764 wrote to memory of 2956	2764	interlock_storage_8_57.exe	38
PID 2764 wrote to memory of 2956	2764	interlock_storage_8_57.exe	38
PID 2764 wrote to memory of 2956	2764	interlock_storage_8_57.exe	38
PID 2764 wrote to memory of 2956	2764	interlock_storage_8_57.exe	38
PID 2764 wrote to memory of 1004	2764	interlock_storage_8_57.exe	40
PID 2764 wrote to memory of 1004	2764	interlock_storage_8_57.exe	40
PID 2764 wrote to memory of 1004	2764	interlock_storage_8_57.exe	40
PID 2764 wrote to memory of 1004	2764	interlock_storage_8_57.exe	40
PID 2764 wrote to memory of 1000	2764	interlock_storage_8_57.exe	43
PID 2764 wrote to memory of 1000	2764	interlock_storage_8_57.exe	43
PID 2764 wrote to memory of 1000	2764	interlock_storage_8_57.exe	43
PID 2764 wrote to memory of 1000	2764	interlock_storage_8_57.exe	43
PID 2764 wrote to memory of 1580	2764	interlock_storage_8_57.exe	45
PID 2764 wrote to memory of 1580	2764	interlock_storage_8_57.exe	45
PID 2764 wrote to memory of 1580	2764	interlock_storage_8_57.exe	45
PID 2764 wrote to memory of 1580	2764	interlock_storage_8_57.exe	45

C:\Users\Admin\AppData\Local\Temp\531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe
"C:\Users\Admin\AppData\Local\Temp\531F6CB76127EAD379D0315A7EF1A3FC61D8FFF1582AA6E4F77CC73259B3E1F2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\system32\ping.exe
  "ping.exe" 5.4.3.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\interlock_storage_8_57.exe
  "C:\Users\Admin\AppData\Local\Temp\\interlock_storage_8_57.exe"
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\PING.EXE
    "C:\Windows\System32\PING.EXE" 22.61.56.108 -n 4
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\interlock_storage_8_57.exe" "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" create SecureElementDataSrv binpath= "C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe delected"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2956
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start SecureElementDataSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1004
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop SecureElementDataSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1000
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" start SecureElementDataSrv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1580

C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe
"C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe" delected
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe
"C:\Program Files (x86)\ExMultimediaStorage\min_id_resolver.exe" delected
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Remote System Discovery

T1018

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\interlock_storage_8_57.exe

Filesize
36KB

MD5
4f6d5d0ba1aa54880f1bcce5ed4858a4

SHA1
06d7f2150ebe20a6c3a0e65a46459b5fe2e9ceb2

SHA256
1cc21e3bbfc910ff2ceb8e63641582bdcca3e479029aa425c55aa346830c6c72

SHA512
fa78f6a16ded41d10bf5a09bfc849452b21e9f0b9d9fe29e9162811aae5912264bf117f30cf2dfd443fa073b925e999ba484ecb6f38b7d8a0f05d839ee40792f

Download Submit
memory/848-21-0x0000000001220000-0x0000000001230000-memory.dmp

Filesize
64KB

Download
memory/1252-19-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2408-0-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmp

Filesize
4KB

Download
memory/2408-1-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2408-2-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2408-3-0x000007FEF5E7E000-0x000007FEF5E7F000-memory.dmp

Filesize
4KB

Download
memory/2408-11-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/2764-12-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Filesize
4KB

Download
memory/2764-13-0x0000000000D40000-0x0000000000D50000-memory.dmp

Filesize
64KB

Download
memory/2764-14-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Filesize
4KB

Download