Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 14:41
Behavioral task
behavioral1
Sample
lets have sex.exe
Resource
win7-20240729-en
windows7-x64
11 signatures
150 seconds
General
-
Target
lets have sex.exe
-
Size
55KB
-
MD5
49fe3af39f2e39b36d6519db50f05b5d
-
SHA1
b96571c6056a6542e2e108565724ff6f8f719191
-
SHA256
97d20ed5cc0e56db47810a100458ebc40a9c3ab4f330d3f2e6c46d3df95ee607
-
SHA512
3a3b7385d53d237c0f1b0f313378fef57e06777bb93a426ba6496d74ffca1b2800b6af9d5f82806221dc4fe8bc9f95087208641770d88ba60e0dbf1d7ac5054b
-
SSDEEP
1536:KeksDnHNwZ8Cam8LDdwsNMDbXExI3pmAm:usDn6SKiDdwsNMDbXExI3pm
Malware Config
Signatures
-
Njrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lets have sex.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe 4468 lets have sex.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe Token: 33 4468 lets have sex.exe Token: SeIncBasePriorityPrivilege 4468 lets have sex.exe