Overview
overview
10Static
static
103c7b097b31...0f.exe
windows7-x64
83c7b097b31...0f.exe
windows10-2004-x64
83c8a6c6cde...86.exe
windows7-x64
103c8a6c6cde...86.exe
windows10-2004-x64
103ca3e4676b...f1.exe
windows7-x64
103ca3e4676b...f1.exe
windows10-2004-x64
103cb47c4bbe...c1.exe
windows7-x64
103cb47c4bbe...c1.exe
windows10-2004-x64
103d18edb3bf...ff.exe
windows7-x64
13d18edb3bf...ff.exe
windows10-2004-x64
3d1ee6caf0...b4.exe
windows7-x64
103d1ee6caf0...b4.exe
windows10-2004-x64
103d2f05086d...0c.exe
windows7-x64
103d2f05086d...0c.exe
windows10-2004-x64
103d81f411b0...ba.exe
windows7-x64
103d81f411b0...ba.exe
windows10-2004-x64
103d90976d58...8c.exe
windows7-x64
103d90976d58...8c.exe
windows10-2004-x64
103d97ea72c5...9e.exe
windows7-x64
103d97ea72c5...9e.exe
windows10-2004-x64
103dd452b939...18.exe
windows7-x64
33dd452b939...18.exe
windows10-2004-x64
33dfc71cfc4...bd.exe
windows7-x64
103dfc71cfc4...bd.exe
windows10-2004-x64
103e435c9ff2...57.exe
windows7-x64
103e435c9ff2...57.exe
windows10-2004-x64
103e624f48a8...2b.exe
windows7-x64
13e624f48a8...2b.exe
windows10-2004-x64
43e8acfab95...cc.exe
windows7-x64
103e8acfab95...cc.exe
windows10-2004-x64
103e9a136b97...9d.exe
windows7-x64
103e9a136b97...9d.exe
windows10-2004-x64
10Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:25
Behavioral task
behavioral1
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c7b097b31ed5df2ce6313dddd86da0f.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
3ca3e4676bac76c4f7eaf0ab169b8af1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
3d18edb3bf6b0493a6572edd73f937ff.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
3d2f05086d9da9564c7c7e945875e80c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win7-20250207-en
Behavioral task
behavioral16
Sample
3d81f411b0ec1ac7d861358e145db4ba.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
3d97ea72c561c7d15574a99be582c59e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
3dd452b9394976fd7b431d3dbae57d18.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
3dfc71cfc45034d671ac0f319bc080bd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
3e435c9ff25f6dca4a3e7262825aa557.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral27
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
3e624f48a849ad8a70e09f6d4e75f02b.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
3e8acfab95493518077e0028fd0f2dcc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
3e9a136b97b7ad7104019ae696b4f59d.exe
Resource
win10v2004-20250314-en
General
-
Target
3cb47c4bbe6856c45fd89eb5eb2723c1.exe
-
Size
114KB
-
MD5
3cb47c4bbe6856c45fd89eb5eb2723c1
-
SHA1
61ec438d8c8e4c382353587bb7eaf2aff7581f1f
-
SHA256
b023de4ecd98db961a3aa5c6aa9f6d79560c5dd72aaa2ea61e907dfac2503bb2
-
SHA512
53b273a1d5355b40664b5d9a5af40bec0315352d511a45d57d8a10693c5f7e7be8972d614eb4e9504bbf4fa455f51c149d891f0a5c29c1a82955d0b678f4a479
-
SSDEEP
1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDI1:P5eznsjsguGDFqGZ2rDI1
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5340 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation 3cb47c4bbe6856c45fd89eb5eb2723c1.exe -
Executes dropped EXE 2 IoCs
pid Process 2628 chargeable.exe 4840 chargeable.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe" 3cb47c4bbe6856c45fd89eb5eb2723c1.exe Set value (str) \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3cb47c4bbe6856c45fd89eb5eb2723c1.exe" 3cb47c4bbe6856c45fd89eb5eb2723c1.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2628 set thread context of 4840 2628 chargeable.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chargeable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3cb47c4bbe6856c45fd89eb5eb2723c1.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe Token: 33 4840 chargeable.exe Token: SeIncBasePriorityPrivilege 4840 chargeable.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2628 3008 3cb47c4bbe6856c45fd89eb5eb2723c1.exe 86 PID 3008 wrote to memory of 2628 3008 3cb47c4bbe6856c45fd89eb5eb2723c1.exe 86 PID 3008 wrote to memory of 2628 3008 3cb47c4bbe6856c45fd89eb5eb2723c1.exe 86 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 2628 wrote to memory of 4840 2628 chargeable.exe 87 PID 4840 wrote to memory of 5340 4840 chargeable.exe 88 PID 4840 wrote to memory of 5340 4840 chargeable.exe 88 PID 4840 wrote to memory of 5340 4840 chargeable.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cb47c4bbe6856c45fd89eb5eb2723c1.exe"C:\Users\Admin\AppData\Local\Temp\3cb47c4bbe6856c45fd89eb5eb2723c1.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Roaming\confuse\chargeable.exeC:\Users\Admin\AppData\Roaming\confuse\chargeable.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:5340
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
400B
MD50a9b4592cd49c3c21f6767c2dabda92f
SHA1f534297527ae5ccc0ecb2221ddeb8e58daeb8b74
SHA256c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd
SHA5126b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307
-
Filesize
115KB
MD57b2975537df31a609bcac4847ce08b92
SHA11fa835055777d9ba40b27348bc3d28392a0e63f5
SHA256b06f867ed1ad4c16ba9b63a3988a70abd8470a2931bcab178eefaa065bddd369
SHA5129e53c4009317d3c4a3b11dd3c02a283982e26e6242d8fe771da6e08f331abd70312f880adf9b88db7c09986b33e7e6b0db40821ba9f38da1f6dc354c2f4bba34