njrat | 60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd

General

Target
60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe
Size 1.1MB
Sample201110-p42dvqphb6
SHA256 60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd
MD5 2a8a7c40ee33672c1bf550814594ecea
SHA1 d903cc7238843324f62003d3017bd39181ae7390
SHA512 21a7c8d8015d1895ca1999a7f004a1b0975fd537bfb4cc52497a387c4ed9222ed40ac4d11cbbcc133a07c36026d387751a570aa53cf3da64b4ed37e90c4710f1
MD5 SHA1 SHA512

Score

10^/10

njrat redlanhopto evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

redlanhopto

C2

redlan.hopto.org:5553

Mutex

d25d360449d7bab3069e1b77b3a914a3

Attributes

reg_key
d25d360449d7bab3069e1b77b3a914a3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
428	data.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00040000000130e4-5.dat	autoit_exe
behavioral1/files/0x00040000000130e4-7.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1352	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe
Token: 33	1120	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1120	RegAsm.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1120	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	29
PID 1744 wrote to memory of 1352	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	30
PID 1744 wrote to memory of 1352	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	30
PID 1744 wrote to memory of 1352	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	30
PID 1744 wrote to memory of 1352	1744	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	30
PID 1120 wrote to memory of 676	1120	RegAsm.exe	32
PID 1120 wrote to memory of 676	1120	RegAsm.exe	32
PID 1120 wrote to memory of 676	1120	RegAsm.exe	32
PID 1120 wrote to memory of 676	1120	RegAsm.exe	32
PID 1688 wrote to memory of 428	1688	taskeng.exe	35
PID 1688 wrote to memory of 428	1688	taskeng.exe	35
PID 1688 wrote to memory of 428	1688	taskeng.exe	35
PID 1688 wrote to memory of 428	1688	taskeng.exe	35

C:\Users\Admin\AppData\Local\Temp\60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe
"C:\Users\Admin\AppData\Local\Temp\60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:676
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1352

C:\Windows\system32\taskeng.exe
taskeng.exe {8268D2D6-6FA7-47CB-B144-57EC9986FF8E} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  2⤵
  - Executes dropped EXE
  PID:428