Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
29/04/2024, 22:27
Behavioral task
behavioral1
Sample
664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe
- Size 425KB
- Sample240429-2dkc7sdc5s
- SHA256 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305
- MD5 72ece7b155cc961b845e3c4b9bdbc25b
- SHA1 12f8afc17eba584ae52935cb39ced0b47280c37f
- SHA512 cfc4c857a0deaea8537f87a5e4c4a1c880ef0af32200038f01f53ca72814f3b908d419d1a0ffba3618c53d6a2417acdac0fdeb433c87ca4ff7676fd4960b2585
- SSDEEP 12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmKo:brl6kD68JmlokQfttqY2Ko
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
14 mai generateur xbox
C2
-
89.94.35.57:1604
Mutex
-
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
- UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral2/memory/3588-0-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-9-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-13-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-14-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-15-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-19-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-20-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-21-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-22-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-23-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-24-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-25-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-26-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-27-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-28-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-29-0x0000000000370000-0x000000000046F000-memory.dmp UPX behavioral2/memory/3588-30-0x0000000000370000-0x000000000046F000-memory.dmp UPX - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3960 netsh.exe -
resource yara_rule behavioral2/memory/3588-0-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-9-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-13-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-14-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-15-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-19-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-20-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-21-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-22-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-23-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-24-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-25-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-26-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-27-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-28-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-29-0x0000000000370000-0x000000000046F000-memory.dmp upx behavioral2/memory/3588-30-0x0000000000370000-0x000000000046F000-memory.dmp upx - AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3588-9-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-13-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-14-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-15-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-19-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-20-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-21-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-22-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-23-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-24-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-25-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-26-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-27-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-28-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-29-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe behavioral2/memory/3588-30-0x0000000000370000-0x000000000046F000-memory.dmp autoit_exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3588 set thread context of 4648 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 92 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe Token: 33 4648 RegAsm.exe Token: SeIncBasePriorityPrivilege 4648 RegAsm.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3588 wrote to memory of 4648 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 92 PID 3588 wrote to memory of 4648 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 92 PID 3588 wrote to memory of 4648 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 92 PID 3588 wrote to memory of 4648 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 92 PID 3588 wrote to memory of 4648 3588 664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe 92 PID 4648 wrote to memory of 3960 4648 RegAsm.exe 93 PID 4648 wrote to memory of 3960 4648 RegAsm.exe 93 PID 4648 wrote to memory of 3960 4648 RegAsm.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe"C:\Users\Admin\AppData\Local\Temp\664c0effa7bb5dc6c5c20c90b9b9ab1553bd57d7f2a4b6dce2fed74728312305.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:3960
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:1100