Analysis
- max time kernel
150s - max time network
125s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:36
Static task
static1
Behavioral task
behavioral1
Sample
23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe
- Size 1.1MB
- Sample201110-k2bthpd8cs
- SHA256 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502
- MD5 adbff000114e0c7648442c7cafe0b665
- SHA1 348e82792daba402d2808e08cde958dbc578e81f
- SHA512 ccced3a13b6e843f6286df0c75443cdce4772ec07f610750026a2ad684eb7ae729fdab1cda3552e1c244a483837c653b491c871e19132b6ebbc790fa9da5eabd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
0.7d
Botnet
-
redlanhopto
C2
-
redlan.hopto.org:5553
Mutex
-
d25d360449d7bab3069e1b77b3a914a3
Attributes
-
reg_key
d25d360449d7bab3069e1b77b3a914a3
-
splitter
|'|'|
Signatures
- Executes dropped EXE 2 IoCs
pid Process 880 data.exe 1864 data.exe - Modifies Windows Firewall 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1068 set thread context of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 880 set thread context of 1488 880 data.exe 36 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00040000000130e9-5.dat autoit_exe behavioral1/files/0x00040000000130e9-7.dat autoit_exe behavioral1/files/0x00040000000130e9-13.dat autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1640 schtasks.exe 1688 schtasks.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe Token: 33 624 RegAsm.exe Token: SeIncBasePriorityPrivilege 624 RegAsm.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 624 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 29 PID 1068 wrote to memory of 1640 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 30 PID 1068 wrote to memory of 1640 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 30 PID 1068 wrote to memory of 1640 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 30 PID 1068 wrote to memory of 1640 1068 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe 30 PID 624 wrote to memory of 1080 624 RegAsm.exe 32 PID 624 wrote to memory of 1080 624 RegAsm.exe 32 PID 624 wrote to memory of 1080 624 RegAsm.exe 32 PID 624 wrote to memory of 1080 624 RegAsm.exe 32 PID 848 wrote to memory of 880 848 taskeng.exe 35 PID 848 wrote to memory of 880 848 taskeng.exe 35 PID 848 wrote to memory of 880 848 taskeng.exe 35 PID 848 wrote to memory of 880 848 taskeng.exe 35 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1488 880 data.exe 36 PID 880 wrote to memory of 1688 880 data.exe 37 PID 880 wrote to memory of 1688 880 data.exe 37 PID 880 wrote to memory of 1688 880 data.exe 37 PID 880 wrote to memory of 1688 880 data.exe 37 PID 848 wrote to memory of 1864 848 taskeng.exe 39 PID 848 wrote to memory of 1864 848 taskeng.exe 39 PID 848 wrote to memory of 1864 848 taskeng.exe 39 PID 848 wrote to memory of 1864 848 taskeng.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe"C:\Users\Admin\AppData\Local\Temp\23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵PID:1080
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1640
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {12E1C130-6D64-4F16-BDDD-7CFE7C4122B4} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exeC:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"3⤵PID:1488
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1688
-
-
-
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exeC:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe2⤵
- Executes dropped EXE
PID:1864
-