Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
31/10/2023, 08:55
Behavioral task
behavioral1
Sample
NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe
Resource
win7-20231023-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe
-
Size
424KB
-
MD5
8a9a696fe491a9268b58e46e2ba57f00
-
SHA1
62684275107824e448fdf1ebbadea5aecbc20c0f
-
SHA256
2f751316822bfb947196b813e618e75ffd06095ce5f59106f6327c621cde5b95
-
SHA512
1e1653fd64028ab1b3193388595860e29bf356b34dc9b462bc99c7429d89206721fe392a1943abdfd23519dd90f719ae21af2b4daf7bf8ea5ab65a81f10c61ea
-
SSDEEP
12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmK/:brl6kD68JmlokQfttqY2K/
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
14 mai generateur xbox
C2
89.94.35.57:1604
Mutex
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2388 netsh.exe -
resource yara_rule behavioral1/memory/1940-0-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-14-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-15-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-18-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-19-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-20-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-21-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-22-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-23-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-24-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-25-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-26-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-27-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-28-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-29-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-30-0x00000000013A0000-0x000000000149F000-memory.dmp upx behavioral1/memory/1940-31-0x00000000013A0000-0x000000000149F000-memory.dmp upx -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1940-14-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-15-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-18-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-19-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-20-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-21-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-22-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-23-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-24-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-25-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-26-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-27-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-28-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-29-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe behavioral1/memory/1940-30-0x00000000013A0000-0x000000000149F000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1940 set thread context of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe Token: 33 2568 RegAsm.exe Token: SeIncBasePriorityPrivilege 2568 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 1940 wrote to memory of 2568 1940 NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe 28 PID 2568 wrote to memory of 2388 2568 RegAsm.exe 29 PID 2568 wrote to memory of 2388 2568 RegAsm.exe 29 PID 2568 wrote to memory of 2388 2568 RegAsm.exe 29 PID 2568 wrote to memory of 2388 2568 RegAsm.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8a9a696fe491a9268b58e46e2ba57f00.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2388
-
-