Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
06/11/2023, 19:30
Behavioral task
behavioral1
Sample
NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe
Resource
win7-20231025-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe
-
Size
425KB
-
MD5
fa44f7c033b1c0a2f3bc565b211e3be0
-
SHA1
36155a36f6a303b87cad27b2349b0646ed9aad75
-
SHA256
7d90fa7177f0bcfca722fcdb80465b1299b9abbe60a66cc1a43511cb723c480f
-
SHA512
ce1906af4ff2c024ba927880c4be387cf3c0b4bb2813065d9e583af58cd8e7a3286e91de4ff883a029b57b61dd46f9101d426086674466bd625e9194b2456047
-
SSDEEP
12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmKE:brl6kD68JmlokQfttqY2KE
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
14 mai generateur xbox
C2
89.94.35.57:1604
Mutex
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2576 netsh.exe -
resource yara_rule behavioral1/memory/2092-0-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-14-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-15-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-17-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-18-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-19-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-20-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-21-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-22-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-23-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-24-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-25-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-26-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-27-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-28-0x0000000000F20000-0x000000000101F000-memory.dmp upx behavioral1/memory/2092-29-0x0000000000F20000-0x000000000101F000-memory.dmp upx -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2092-14-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-15-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-17-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-18-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-19-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-20-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-21-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-22-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-23-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-24-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-25-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-26-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-27-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-28-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe behavioral1/memory/2092-29-0x0000000000F20000-0x000000000101F000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2092 set thread context of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe Token: 33 844 RegAsm.exe Token: SeIncBasePriorityPrivilege 844 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 2092 wrote to memory of 844 2092 NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe 28 PID 844 wrote to memory of 2576 844 RegAsm.exe 29 PID 844 wrote to memory of 2576 844 RegAsm.exe 29 PID 844 wrote to memory of 2576 844 RegAsm.exe 29 PID 844 wrote to memory of 2576 844 RegAsm.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fa44f7c033b1c0a2f3bc565b211e3be0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2576
-
-