Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10ne-bot/ne-...4).exe
windows7-x64
10ne-bot/ne-...4).exe
windows10-2004-x64
10ne-bot/ne-...6).exe
windows7-x64
10ne-bot/ne-...6).exe
windows10-2004-x64
10ne-bot/ne-bot edc.dll
windows7-x64
3ne-bot/ne-bot edc.dll
windows10-2004-x64
3ne-bot/ne-bot.dll
windows7-x64
3ne-bot/ne-bot.dll
windows10-2004-x64
3ne-bot/ne_up.exe
windows7-x64
10ne-bot/ne_up.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2024, 20:15
Behavioral task
behavioral1
Sample
ne-bot/ne-bot beta v.1.1 (x64).exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ne-bot/ne-bot beta v.1.1 (x64).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ne-bot/ne-bot beta v.1.1 (x86).exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
ne-bot/ne-bot beta v.1.1 (x86).exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ne-bot/ne-bot edc.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
ne-bot/ne-bot edc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ne-bot/ne-bot.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
ne-bot/ne-bot.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ne-bot/ne_up.exe
Resource
win7-20240708-en
General
-
Target
ne-bot/ne-bot beta v.1.1 (x86).exe
-
Size
596KB
-
MD5
8ead6aa52c8f84637c95a64deef536c5
-
SHA1
d1e6fd86f7b47ccd11b8ffadc7f74b9721f9bb2e
-
SHA256
76ebd0d9944b3557c7f2575ae985774950a00156d84e524dd963986e352222ac
-
SHA512
ec878cfbec7e0bac0b9db02c7529e2886639870f255b5a30ba46b49d72e2a86744dd12d0056c4d3a3d700226280cb283c34be5cc6e635619cb5bc16305471166
-
SSDEEP
12288:fjkArEN249AyE/rbaMct4bO2/VEU5fXIyNOFF2VdEmmVCPf:MFE//Tct4bOsLQYOz2VdEz43
Malware Config
Extracted
xtremerat
yourchance19.no-ip.biz
Signatures
-
Detect XtremeRAT payload 6 IoCs
resource yara_rule behavioral4/memory/4248-2-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/3636-3-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/1400-5-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/3636-8-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/4248-9-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat behavioral4/memory/3636-11-0x0000000010000000-0x000000001004D000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y5067W0U-0ONK-M06F-73IJ-3JF4L4HG013C} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y5067W0U-0ONK-M06F-73IJ-3JF4L4HG013C}\StubPath = "C:\\Windows\\system32\\enm\\update.exe restart" svchost.exe -
resource yara_rule behavioral4/memory/464-0-0x0000000000400000-0x0000000000511000-memory.dmp upx behavioral4/memory/1400-1-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/4248-2-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/3636-3-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/464-6-0x0000000000400000-0x0000000000511000-memory.dmp upx behavioral4/memory/1400-5-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/3636-8-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/4248-9-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/3636-11-0x0000000010000000-0x000000001004D000-memory.dmp upx behavioral4/memory/464-12-0x0000000000400000-0x0000000000511000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\system32\\enm\\update.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\system32\\enm\\update.exe" svchost.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral4/memory/464-6-0x0000000000400000-0x0000000000511000-memory.dmp autoit_exe behavioral4/memory/464-12-0x0000000000400000-0x0000000000511000-memory.dmp autoit_exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\enm\update.exe svchost.exe File created C:\Windows\SysWOW64\enm\update.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1432 4248 WerFault.exe 93 4432 4248 WerFault.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ne-bot beta v.1.1 (x86).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ne_up.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 464 ne-bot beta v.1.1 (x86).exe -
Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe -
Suspicious use of SendNotifyMessage 20 IoCs
pid Process 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe 464 ne-bot beta v.1.1 (x86).exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3636 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 464 wrote to memory of 1400 464 ne-bot beta v.1.1 (x86).exe 92 PID 464 wrote to memory of 1400 464 ne-bot beta v.1.1 (x86).exe 92 PID 464 wrote to memory of 1400 464 ne-bot beta v.1.1 (x86).exe 92 PID 1400 wrote to memory of 4248 1400 ne_up.exe 93 PID 1400 wrote to memory of 4248 1400 ne_up.exe 93 PID 1400 wrote to memory of 4248 1400 ne_up.exe 93 PID 1400 wrote to memory of 4248 1400 ne_up.exe 93 PID 1400 wrote to memory of 3636 1400 ne_up.exe 94 PID 1400 wrote to memory of 3636 1400 ne_up.exe 94 PID 1400 wrote to memory of 3636 1400 ne_up.exe 94 PID 1400 wrote to memory of 3636 1400 ne_up.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ne-bot\ne-bot beta v.1.1 (x86).exe"C:\Users\Admin\AppData\Local\Temp\ne-bot\ne-bot beta v.1.1 (x86).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\ne-bot\ne_up.exene_up.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 4804⤵
- Program crash
PID:1432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 4884⤵
- Program crash
PID:4432
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4248 -ip 42481⤵PID:3220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4248 -ip 42481⤵PID:1552
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1