Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 18:40
Behavioral task
behavioral1
Sample
0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe
-
Size
425KB
-
MD5
a628a39ae77b218259fdb1c294717b41
-
SHA1
22abd715a92542e14ce207657474a24b6f39823f
-
SHA256
0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c
-
SHA512
5d5a7441630b4e59bd93768bef3962c99ae420c8338907ef53598f5fabcc550371046ed8481709e2f64e2ac27d95a9ac3c60e1078c5c4a9594dbc69ec2c0d926
-
SSDEEP
12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmKb:brl6kD68JmlokQfttqY2Kb
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
14 mai generateur xbox
C2
89.94.35.57:1604
Mutex
ef05e501c2e286164abf5fcaa961559f
Attributes
-
reg_key
ef05e501c2e286164abf5fcaa961559f
-
splitter
|'|'|
Signatures
-
UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral1/memory/2904-0-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-14-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-15-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-16-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-19-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-20-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-21-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-22-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-23-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-24-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-25-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-26-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-27-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-28-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-29-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX behavioral1/memory/2904-30-0x00000000010F0000-0x00000000011EF000-memory.dmp UPX -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2512 netsh.exe -
resource yara_rule behavioral1/memory/2904-0-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-14-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-15-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-16-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-19-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-20-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-21-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-22-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-23-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-24-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-25-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-26-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-27-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-28-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-29-0x00000000010F0000-0x00000000011EF000-memory.dmp upx behavioral1/memory/2904-30-0x00000000010F0000-0x00000000011EF000-memory.dmp upx -
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2904-14-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-15-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-16-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-19-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-20-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-21-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-22-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-23-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-24-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-25-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-26-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-27-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-28-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-29-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe behavioral1/memory/2904-30-0x00000000010F0000-0x00000000011EF000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2904 set thread context of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe Token: 33 2540 RegAsm.exe Token: SeIncBasePriorityPrivilege 2540 RegAsm.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2904 wrote to memory of 2540 2904 0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe 28 PID 2540 wrote to memory of 2512 2540 RegAsm.exe 29 PID 2540 wrote to memory of 2512 2540 RegAsm.exe 29 PID 2540 wrote to memory of 2512 2540 RegAsm.exe 29 PID 2540 wrote to memory of 2512 2540 RegAsm.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe"C:\Users\Admin\AppData\Local\Temp\0f9294d4e372355c95decdc76aae406ca36e99dc7a12bfffde98c13ce201c44c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2512
-
-