Analysis
-
max time kernel
212s -
max time network
235s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 18:52
Behavioral task
behavioral1
Sample
NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe
Resource
win7-20230831-en
General
-
Target
NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe
-
Size
160KB
-
MD5
0ff4ee90b781b9f295724ef48a10de70
-
SHA1
77a57b29f1aab01ffe89d7ab9778035a393456e8
-
SHA256
49281ec5f3bdbbe86268bddcdd59909573420a7d751639d9d10d66a48f3d5d4c
-
SHA512
f29f8cd0ad8e27f579d0c787b84dfdcfab2e33601cb8f79469af1be3ec680e5c0a0e565dd47f3ce89b9b549885aebff3bd517155355bef2a731e5738e9e7ba78
-
SSDEEP
3072:3rRIjYn+gbwtRJR6agMAZtxEYqGBoNcvyal5bx/jz1t5PWY:VdChB3AZtWOo5a3bNz1t4
Malware Config
Signatures
-
Async RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4556-0-0x0000000000130000-0x000000000015E000-memory.dmp asyncrat behavioral2/files/0x00070000000231e1-13.dat asyncrat behavioral2/files/0x00070000000231e1-14.dat asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe -
Executes dropped EXE 1 IoCs
pid Process 4796 RuntimeBroker.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/4556-0-0x0000000000130000-0x000000000015E000-memory.dmp agile_net behavioral2/files/0x00070000000231e1-13.dat agile_net behavioral2/files/0x00070000000231e1-14.dat agile_net -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4256 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 3572 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 4796 RuntimeBroker.exe 4796 RuntimeBroker.exe 4796 RuntimeBroker.exe 4796 RuntimeBroker.exe 4796 RuntimeBroker.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe Token: SeDebugPrivilege 4796 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4796 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4556 wrote to memory of 392 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 84 PID 4556 wrote to memory of 392 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 84 PID 4556 wrote to memory of 4808 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 85 PID 4556 wrote to memory of 4808 4556 NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe 85 PID 392 wrote to memory of 4256 392 cmd.exe 87 PID 392 wrote to memory of 4256 392 cmd.exe 87 PID 4808 wrote to memory of 3572 4808 cmd.exe 88 PID 4808 wrote to memory of 3572 4808 cmd.exe 88 PID 4808 wrote to memory of 4796 4808 cmd.exe 89 PID 4808 wrote to memory of 4796 4808 cmd.exe 89 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0ff4ee90b781b9f295724ef48a10de70_JC.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'3⤵
- Creates scheduled task(s)
PID:4256
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4915.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:3572
-
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5c272458fe2dc22ce9eb6fcd6d721b280
SHA1820ffc70a003d25da8646f44e8a6d039ebcf2343
SHA2561244a726739de62ef0fbc4cbadf688e861f1daf1fc4b929cdb530f68d752638e
SHA512e95e460946047c5ae06f8331e419761d8e6cda724f4fce0c44861e79fe2ba0471eb352b45fad3d3f4eeac824af3bb96bb594502bee097056aad14b0670556ee0
-
Filesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
Filesize
160KB
MD50ff4ee90b781b9f295724ef48a10de70
SHA177a57b29f1aab01ffe89d7ab9778035a393456e8
SHA25649281ec5f3bdbbe86268bddcdd59909573420a7d751639d9d10d66a48f3d5d4c
SHA512f29f8cd0ad8e27f579d0c787b84dfdcfab2e33601cb8f79469af1be3ec680e5c0a0e565dd47f3ce89b9b549885aebff3bd517155355bef2a731e5738e9e7ba78
-
Filesize
160KB
MD50ff4ee90b781b9f295724ef48a10de70
SHA177a57b29f1aab01ffe89d7ab9778035a393456e8
SHA25649281ec5f3bdbbe86268bddcdd59909573420a7d751639d9d10d66a48f3d5d4c
SHA512f29f8cd0ad8e27f579d0c787b84dfdcfab2e33601cb8f79469af1be3ec680e5c0a0e565dd47f3ce89b9b549885aebff3bd517155355bef2a731e5738e9e7ba78