Analysis
-
max time kernel
140s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 18:52
Behavioral task
behavioral1
Sample
NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe
Resource
win7-20230831-en
General
-
Target
NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe
-
Size
160KB
-
MD5
0ff4ee90b781b9f295724ef48a10de70
-
SHA1
77a57b29f1aab01ffe89d7ab9778035a393456e8
-
SHA256
49281ec5f3bdbbe86268bddcdd59909573420a7d751639d9d10d66a48f3d5d4c
-
SHA512
f29f8cd0ad8e27f579d0c787b84dfdcfab2e33601cb8f79469af1be3ec680e5c0a0e565dd47f3ce89b9b549885aebff3bd517155355bef2a731e5738e9e7ba78
-
SSDEEP
3072:3rRIjYn+gbwtRJR6agMAZtxEYqGBoNcvyal5bx/jz1t5PWY:VdChB3AZtWOo5a3bNz1t4
Malware Config
Signatures
-
Async RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2052-0-0x0000000000880000-0x00000000008AE000-memory.dmp asyncrat behavioral1/files/0x0035000000014b3d-17.dat asyncrat behavioral1/files/0x0035000000014b3d-18.dat asyncrat behavioral1/memory/2608-19-0x0000000000AB0000-0x0000000000ADE000-memory.dmp asyncrat -
Executes dropped EXE 1 IoCs
pid Process 2608 RuntimeBroker.exe -
Obfuscated with Agile.Net obfuscator 4 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/2052-0-0x0000000000880000-0x00000000008AE000-memory.dmp agile_net behavioral1/files/0x0035000000014b3d-17.dat agile_net behavioral1/files/0x0035000000014b3d-18.dat agile_net behavioral1/memory/2608-19-0x0000000000AB0000-0x0000000000ADE000-memory.dmp agile_net -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2712 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2640 timeout.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 2608 RuntimeBroker.exe 2608 RuntimeBroker.exe 2608 RuntimeBroker.exe 2608 RuntimeBroker.exe 2608 RuntimeBroker.exe 2608 RuntimeBroker.exe 2608 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe Token: SeDebugPrivilege 2608 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2608 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2648 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 28 PID 2052 wrote to memory of 2648 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 28 PID 2052 wrote to memory of 2648 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 28 PID 2052 wrote to memory of 2792 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 30 PID 2052 wrote to memory of 2792 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 30 PID 2052 wrote to memory of 2792 2052 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 30 PID 2648 wrote to memory of 2712 2648 cmd.exe 32 PID 2648 wrote to memory of 2712 2648 cmd.exe 32 PID 2648 wrote to memory of 2712 2648 cmd.exe 32 PID 2792 wrote to memory of 2640 2792 cmd.exe 33 PID 2792 wrote to memory of 2640 2792 cmd.exe 33 PID 2792 wrote to memory of 2640 2792 cmd.exe 33 PID 2792 wrote to memory of 2608 2792 cmd.exe 34 PID 2792 wrote to memory of 2608 2792 cmd.exe 34 PID 2792 wrote to memory of 2608 2792 cmd.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'3⤵
- Creates scheduled task(s)
PID:2712
-
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8B5E.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2640
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
157B
MD578c287b210a9df0935a5d5f8a49c8e41
SHA1bd9b789cbe737825505aa7c005907a481fd17af8
SHA2562885c359a29cc9c8eac90f72ac06a7aff73174289ce394cb151559fb289c2c09
SHA512c8d898d9f0bf73a6e679662dfcaaa44873d9a829f2df8799d45244e405846dd3efa9121297e4855223ce49cf2534cef51d7f25555196013b960a0a66af558e58
-
Filesize
157B
MD578c287b210a9df0935a5d5f8a49c8e41
SHA1bd9b789cbe737825505aa7c005907a481fd17af8
SHA2562885c359a29cc9c8eac90f72ac06a7aff73174289ce394cb151559fb289c2c09
SHA512c8d898d9f0bf73a6e679662dfcaaa44873d9a829f2df8799d45244e405846dd3efa9121297e4855223ce49cf2534cef51d7f25555196013b960a0a66af558e58
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
160KB
MD50ff4ee90b781b9f295724ef48a10de70
SHA177a57b29f1aab01ffe89d7ab9778035a393456e8
SHA25649281ec5f3bdbbe86268bddcdd59909573420a7d751639d9d10d66a48f3d5d4c
SHA512f29f8cd0ad8e27f579d0c787b84dfdcfab2e33601cb8f79469af1be3ec680e5c0a0e565dd47f3ce89b9b549885aebff3bd517155355bef2a731e5738e9e7ba78
-
Filesize
160KB
MD50ff4ee90b781b9f295724ef48a10de70
SHA177a57b29f1aab01ffe89d7ab9778035a393456e8
SHA25649281ec5f3bdbbe86268bddcdd59909573420a7d751639d9d10d66a48f3d5d4c
SHA512f29f8cd0ad8e27f579d0c787b84dfdcfab2e33601cb8f79469af1be3ec680e5c0a0e565dd47f3ce89b9b549885aebff3bd517155355bef2a731e5738e9e7ba78