njrat | 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8

General

Target
0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe
Size 1.1MB
Sample201110-84abl3j196
SHA256 0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8
MD5 a9004da400040339f0d6df4b659c9d98
SHA1 933c717bbc95fc8d1a394f602b82a0d3170fa228
SHA512 53fc405d1c7f2da65526a6805f8606d05f476838ca74a4b1911b279259e5a2198419f752472ba3103cf0c569d7162fcd2835a2f64d4c3995e251f5f2efc6734c
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 2 IoCs

pid	Process
4060	data.exe
3204	data.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3372 set thread context of 740	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	78
PID 4060 set thread context of 3200	4060	data.exe	84

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1448	schtasks.exe
1452	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe
Token: 33	740	RegAsm.exe
Token: SeIncBasePriorityPrivilege	740	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 740	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	78
PID 3372 wrote to memory of 740	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	78
PID 3372 wrote to memory of 740	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	78
PID 3372 wrote to memory of 740	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	78
PID 3372 wrote to memory of 740	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	78
PID 3372 wrote to memory of 1448	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	79
PID 3372 wrote to memory of 1448	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	79
PID 3372 wrote to memory of 1448	3372	0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe	79
PID 740 wrote to memory of 508	740	RegAsm.exe	81
PID 740 wrote to memory of 508	740	RegAsm.exe	81
PID 740 wrote to memory of 508	740	RegAsm.exe	81
PID 4060 wrote to memory of 3200	4060	data.exe	84
PID 4060 wrote to memory of 3200	4060	data.exe	84
PID 4060 wrote to memory of 3200	4060	data.exe	84
PID 4060 wrote to memory of 3200	4060	data.exe	84
PID 4060 wrote to memory of 3200	4060	data.exe	84
PID 4060 wrote to memory of 1452	4060	data.exe	85
PID 4060 wrote to memory of 1452	4060	data.exe	85
PID 4060 wrote to memory of 1452	4060	data.exe	85

C:\Users\Admin\AppData\Local\Temp\0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe
"C:\Users\Admin\AppData\Local\Temp\0c3d29652f673f9b41240038596e57ffb280e3ba0c5e519be3aead68ebd398e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1448

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3200
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1452

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:3204