njrat | 4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0

General

Target
4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe
Size 1.1MB
Sample201110-egejp9l5lx
SHA256 4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0
MD5 ca3cc16852a7648306ea789348ba3286
SHA1 9df06b544edf9b010f3758ce8e992bb88c4ea8df
SHA512 c8924f497e485abf8eddd7afd5c6235de785d166fc1aeec808eb1895f2c8bf3a0e562f47a8dd66033d615b9cfa22e667e030b2583c3b6bf7cf5520866758dcb0
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 2 IoCs

pid	Process
632	data.exe
1884	data.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 3848	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	78
PID 632 set thread context of 1236	632	data.exe	84

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1468	schtasks.exe
68	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe
Token: 33	3848	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3848	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3848	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	78
PID 4684 wrote to memory of 3848	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	78
PID 4684 wrote to memory of 3848	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	78
PID 4684 wrote to memory of 3848	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	78
PID 4684 wrote to memory of 3848	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	78
PID 4684 wrote to memory of 68	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	79
PID 4684 wrote to memory of 68	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	79
PID 4684 wrote to memory of 68	4684	4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe	79
PID 3848 wrote to memory of 796	3848	RegAsm.exe	82
PID 3848 wrote to memory of 796	3848	RegAsm.exe	82
PID 3848 wrote to memory of 796	3848	RegAsm.exe	82
PID 632 wrote to memory of 1236	632	data.exe	84
PID 632 wrote to memory of 1236	632	data.exe	84
PID 632 wrote to memory of 1236	632	data.exe	84
PID 632 wrote to memory of 1236	632	data.exe	84
PID 632 wrote to memory of 1236	632	data.exe	84
PID 632 wrote to memory of 1468	632	data.exe	85
PID 632 wrote to memory of 1468	632	data.exe	85
PID 632 wrote to memory of 1468	632	data.exe	85

C:\Users\Admin\AppData\Local\Temp\4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe
"C:\Users\Admin\AppData\Local\Temp\4c14d8137e225d03bcc84f9296d86ab32c67b2fefe72049abf6f4e431acf70e0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:796
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:68

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1236
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1468

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1884