Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 02:17
Behavioral task
behavioral1
Sample
bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe
-
Size
425KB
-
MD5
b9a55c795b8b1ea38fe9a8f4549f2762
-
SHA1
ad8ba6823cd36261f21527391ff32532ef3cbdb4
-
SHA256
bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69
-
SHA512
0ebc3b25ce7855cf0df78d6eb12adf07fc55e881d55d762e74f8638d3f9821e6e90a9daac10c8d71cf49f9ee084ffadd180c6728ab098a35c52755f64c063e01
-
SSDEEP
12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmKz:brl6kD68JmlokQfttqY2Kz
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
14 mai generateur xbox
C2
89.94.35.57:1604
Mutex
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
-
UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral1/memory/1124-0-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-14-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-15-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-16-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-19-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-20-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-21-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-22-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-23-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-24-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-25-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-26-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-27-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-28-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-29-0x0000000001350000-0x000000000144F000-memory.dmp UPX behavioral1/memory/1124-30-0x0000000001350000-0x000000000144F000-memory.dmp UPX -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2564 netsh.exe -
resource yara_rule behavioral1/memory/1124-0-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-14-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-15-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-16-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-19-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-20-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-21-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-22-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-23-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-24-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-25-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-26-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-27-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-28-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-29-0x0000000001350000-0x000000000144F000-memory.dmp upx behavioral1/memory/1124-30-0x0000000001350000-0x000000000144F000-memory.dmp upx -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1124-14-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-15-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-16-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-19-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-20-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-21-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-22-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-23-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-24-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-25-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-26-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-27-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-28-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-29-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe behavioral1/memory/1124-30-0x0000000001350000-0x000000000144F000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1124 set thread context of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe Token: 33 1728 RegAsm.exe Token: SeIncBasePriorityPrivilege 1728 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1124 wrote to memory of 1728 1124 bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe 28 PID 1728 wrote to memory of 2564 1728 RegAsm.exe 29 PID 1728 wrote to memory of 2564 1728 RegAsm.exe 29 PID 1728 wrote to memory of 2564 1728 RegAsm.exe 29 PID 1728 wrote to memory of 2564 1728 RegAsm.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe"C:\Users\Admin\AppData\Local\Temp\bd0d8aaf3c8509f3170b3464a4949cf87a936c3fc1e3a16a2665b085a7046a69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2564
-
-