Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2023, 19:49
Behavioral task
behavioral1
Sample
e933200c50ed87ef3215904c3cfe2920_exe32.exe
Resource
win7-20230831-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
e933200c50ed87ef3215904c3cfe2920_exe32.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e933200c50ed87ef3215904c3cfe2920_exe32.exe
-
Size
425KB
-
MD5
e933200c50ed87ef3215904c3cfe2920
-
SHA1
bad3bb1e8893109821672db903adb71b2af3b007
-
SHA256
936a934e72770ce483d26756349d19b97479945e829162d1f53787237b08c666
-
SHA512
bf9cb20cab6abdab4a9746a31101514bb035df47045457c1a88000f2c3a76c66c377ab48a3c42b582969d29a7e8001d5fb5eb11b71f536d473ad798a1cd8a2c5
-
SSDEEP
12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmK8:brl6kD68JmlokQfttqY2K8
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
14 mai generateur xbox
C2
89.94.35.57:1604
Mutex
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2040 netsh.exe -
resource yara_rule behavioral2/memory/3280-0-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-12-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-15-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-18-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-19-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-20-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-21-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-22-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-23-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-24-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-25-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-26-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-27-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-28-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-29-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-30-0x0000000000030000-0x000000000012F000-memory.dmp upx behavioral2/memory/3280-31-0x0000000000030000-0x000000000012F000-memory.dmp upx -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3280-12-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-15-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-18-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-19-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-20-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-21-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-22-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-23-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-24-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-25-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-26-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-27-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-28-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-29-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-30-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe behavioral2/memory/3280-31-0x0000000000030000-0x000000000012F000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3280 set thread context of 5000 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 83 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe Token: 33 5000 RegAsm.exe Token: SeIncBasePriorityPrivilege 5000 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3280 wrote to memory of 5000 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 83 PID 3280 wrote to memory of 5000 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 83 PID 3280 wrote to memory of 5000 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 83 PID 3280 wrote to memory of 5000 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 83 PID 3280 wrote to memory of 5000 3280 e933200c50ed87ef3215904c3cfe2920_exe32.exe 83 PID 5000 wrote to memory of 2040 5000 RegAsm.exe 90 PID 5000 wrote to memory of 2040 5000 RegAsm.exe 90 PID 5000 wrote to memory of 2040 5000 RegAsm.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\e933200c50ed87ef3215904c3cfe2920_exe32.exe"C:\Users\Admin\AppData\Local\Temp\e933200c50ed87ef3215904c3cfe2920_exe32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2040
-
-