njrat | 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502

General

Target
23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe
Size 1.1MB
Sample201110-k2bthpd8cs
SHA256 23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502
MD5 adbff000114e0c7648442c7cafe0b665
SHA1 348e82792daba402d2808e08cde958dbc578e81f
SHA512 ccced3a13b6e843f6286df0c75443cdce4772ec07f610750026a2ad684eb7ae729fdab1cda3552e1c244a483837c653b491c871e19132b6ebbc790fa9da5eabd
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 2 IoCs

pid	Process
896	data.exe
1876	data.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 3980	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	78
PID 896 set thread context of 1236	896	data.exe	84

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
68	schtasks.exe
1468	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe
Token: 33	3980	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3980	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3980	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	78
PID 4684 wrote to memory of 3980	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	78
PID 4684 wrote to memory of 3980	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	78
PID 4684 wrote to memory of 3980	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	78
PID 4684 wrote to memory of 3980	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	78
PID 4684 wrote to memory of 68	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	79
PID 4684 wrote to memory of 68	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	79
PID 4684 wrote to memory of 68	4684	23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe	79
PID 3980 wrote to memory of 628	3980	RegAsm.exe	81
PID 3980 wrote to memory of 628	3980	RegAsm.exe	81
PID 3980 wrote to memory of 628	3980	RegAsm.exe	81
PID 896 wrote to memory of 1236	896	data.exe	84
PID 896 wrote to memory of 1236	896	data.exe	84
PID 896 wrote to memory of 1236	896	data.exe	84
PID 896 wrote to memory of 1236	896	data.exe	84
PID 896 wrote to memory of 1236	896	data.exe	84
PID 896 wrote to memory of 1468	896	data.exe	85
PID 896 wrote to memory of 1468	896	data.exe	85
PID 896 wrote to memory of 1468	896	data.exe	85

C:\Users\Admin\AppData\Local\Temp\23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe
"C:\Users\Admin\AppData\Local\Temp\23d10d990d1f3732130eb4a5113b87f3736aa646b0f4ac282fa9cda9aa276502.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:628
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:68

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1236
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1468

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1876