Analysis
- max time kernel
149s - max time network
68s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe
- Size 1.1MB
- Sample201110-84abl3j196
- SHA256 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8
- MD5 a9004da400040339f0d6df4b659c9d98
- SHA1 933c717bbc95fc8d1a394f602b82a0d3170fa228
- SHA512 53fc405d1c7f2da65526a6805f8606d05f476838ca74a4b1911b279259e5a2198419f752472ba3103cf0c569d7162fcd2835a2f64d4c3995e251f5f2efc6734c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
redlanhopto
C2
-
redlan.hopto.org:5553
Mutex
-
d25d360449d7bab3069e1b77b3a914a3
Attributes
-
reg_key
d25d360449d7bab3069e1b77b3a914a3
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 740 data.exe 1716 data.exe - Modifies Windows Firewall 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1320 set thread context of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 740 set thread context of 1556 740 data.exe 36 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00040000000130ff-5.dat autoit_exe behavioral1/files/0x00040000000130ff-7.dat autoit_exe behavioral1/files/0x00040000000130ff-13.dat autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1676 schtasks.exe 1064 schtasks.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe Token: 33 1720 RegAsm.exe Token: SeIncBasePriorityPrivilege 1720 RegAsm.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1720 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 29 PID 1320 wrote to memory of 1676 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 30 PID 1320 wrote to memory of 1676 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 30 PID 1320 wrote to memory of 1676 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 30 PID 1320 wrote to memory of 1676 1320 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe 30 PID 1720 wrote to memory of 1292 1720 RegAsm.exe 32 PID 1720 wrote to memory of 1292 1720 RegAsm.exe 32 PID 1720 wrote to memory of 1292 1720 RegAsm.exe 32 PID 1720 wrote to memory of 1292 1720 RegAsm.exe 32 PID 1020 wrote to memory of 740 1020 taskeng.exe 35 PID 1020 wrote to memory of 740 1020 taskeng.exe 35 PID 1020 wrote to memory of 740 1020 taskeng.exe 35 PID 1020 wrote to memory of 740 1020 taskeng.exe 35 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1556 740 data.exe 36 PID 740 wrote to memory of 1064 740 data.exe 37 PID 740 wrote to memory of 1064 740 data.exe 37 PID 740 wrote to memory of 1064 740 data.exe 37 PID 740 wrote to memory of 1064 740 data.exe 37 PID 1020 wrote to memory of 1716 1020 taskeng.exe 39 PID 1020 wrote to memory of 1716 1020 taskeng.exe 39 PID 1020 wrote to memory of 1716 1020 taskeng.exe 39 PID 1020 wrote to memory of 1716 1020 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe"C:\Users\Admin\AppData\Local\Temp\0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵PID:1292
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1676
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {DBB9BE3A-0C36-4801-9D52-23D25E0B8E62} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exeC:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1556
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1064
-
-
-
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exeC:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe2⤵
- Executes dropped EXE
PID:1716
-