Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 02:26
Static task
static1
Behavioral task
behavioral1
Sample
5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe
Resource
win10v2004-20241007-en
General
-
Target
5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe
-
Size
114KB
-
MD5
01147c2d8d629fb6a6902102f2513f01
-
SHA1
21dbf1fa09d529fc00a598567449ca09f059f0ec
-
SHA256
5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1
-
SHA512
0a7f6087ca037036c6295ddecc121a7d9c244a81da12515f16b6db81454a84a4f68054a6533bd0ea6fbf05131c26f679f9332b9b2d50d002669b434ae3a8c433
-
SSDEEP
1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73vry:w5eznsjsguGDFqGx8egoxmO3rvm
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1924 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe -
Executes dropped EXE 4 IoCs
pid Process 3696 chargeable.exe 4048 chargeable.exe 5040 chargeable.exe 3924 chargeable.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe" 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3696 set thread context of 4048 3696 chargeable.exe 90 PID 3696 set thread context of 5040 3696 chargeable.exe 89 PID 3696 set thread context of 3924 3696 chargeable.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 2 IoCs
pid pid_target Process 3440 3924 WerFault.exe 1056 5040 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe Token: 33 4048 chargeable.exe Token: SeIncBasePriorityPrivilege 4048 chargeable.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2396 wrote to memory of 3696 2396 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe 86 PID 2396 wrote to memory of 3696 2396 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe 86 PID 2396 wrote to memory of 3696 2396 5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe 86 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 4048 3696 chargeable.exe 90 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 5040 3696 chargeable.exe 89 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 3696 wrote to memory of 3924 3696 chargeable.exe 88 PID 4048 wrote to memory of 1924 4048 chargeable.exe 98 PID 4048 wrote to memory of 1924 4048 chargeable.exe 98 PID 4048 wrote to memory of 1924 4048 chargeable.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe"C:\Users\Admin\AppData\Local\Temp\5054140f8650c862a10697b8f1e3ef9cb07e78359df6d0a3e645e5c8bf0efde1.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 804⤵
- Program crash
PID:3440
-
-
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
PID:5040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 844⤵
- Program crash
PID:1056
-
-
-
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1924
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3924 -ip 39241⤵PID:2112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5040 -ip 50401⤵PID:3164
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
Filesize
114KB
MD570be0a47cb24c757703527e7cb13c1b9
SHA138f8bd32a63e0f5a2f96075534013a8ea2cc7f71
SHA25637a5e0e71058ab5870abefa14c125eee3f589f720b9006e4cc7b9027fb04c522
SHA5128ef8383e3e9df2c7f31bf086d03ac39fead22e138f0a72e430f64c75cb6aa2e8f318413eb389b0decd89814b800edd89d12ded886b77ccdd6406466252918afd