Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15/10/2023, 19:49
Behavioral task
behavioral1
Sample
e933200c50ed87ef3215904c3cfe2920_exe32.exe
Resource
win7-20230831-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e933200c50ed87ef3215904c3cfe2920_exe32.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e933200c50ed87ef3215904c3cfe2920_exe32.exe
-
Size
425KB
-
MD5
e933200c50ed87ef3215904c3cfe2920
-
SHA1
bad3bb1e8893109821672db903adb71b2af3b007
-
SHA256
936a934e72770ce483d26756349d19b97479945e829162d1f53787237b08c666
-
SHA512
bf9cb20cab6abdab4a9746a31101514bb035df47045457c1a88000f2c3a76c66c377ab48a3c42b582969d29a7e8001d5fb5eb11b71f536d473ad798a1cd8a2c5
-
SSDEEP
12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmK8:brl6kD68JmlokQfttqY2K8
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
14 mai generateur xbox
C2
89.94.35.57:1604
Mutex
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2664 netsh.exe -
resource yara_rule behavioral1/memory/1664-0-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-14-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-15-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-18-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-19-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-20-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-21-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-22-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-23-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-24-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-25-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-26-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-27-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-28-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-29-0x0000000001280000-0x000000000137F000-memory.dmp upx behavioral1/memory/1664-30-0x0000000001280000-0x000000000137F000-memory.dmp upx -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1664-14-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-15-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-18-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-19-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-20-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-21-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-22-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-23-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-24-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-25-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-26-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-27-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-28-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-29-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe behavioral1/memory/1664-30-0x0000000001280000-0x000000000137F000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1664 set thread context of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe Token: 33 3012 RegAsm.exe Token: SeIncBasePriorityPrivilege 3012 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 1664 wrote to memory of 3012 1664 e933200c50ed87ef3215904c3cfe2920_exe32.exe 28 PID 3012 wrote to memory of 2664 3012 RegAsm.exe 29 PID 3012 wrote to memory of 2664 3012 RegAsm.exe 29 PID 3012 wrote to memory of 2664 3012 RegAsm.exe 29 PID 3012 wrote to memory of 2664 3012 RegAsm.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e933200c50ed87ef3215904c3cfe2920_exe32.exe"C:\Users\Admin\AppData\Local\Temp\e933200c50ed87ef3215904c3cfe2920_exe32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2664
-
-