njrat | 60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd

General

Target
60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe
Size 1.1MB
Sample201110-p42dvqphb6
SHA256 60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd
MD5 2a8a7c40ee33672c1bf550814594ecea
SHA1 d903cc7238843324f62003d3017bd39181ae7390
SHA512 21a7c8d8015d1895ca1999a7f004a1b0975fd537bfb4cc52497a387c4ed9222ed40ac4d11cbbcc133a07c36026d387751a570aa53cf3da64b4ed37e90c4710f1
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
1516	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4052 set thread context of 2828	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000500000001a4f4-4.dat	autoit_exe
behavioral2/files/0x000500000001a4f4-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
200	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe
Token: 33	2828	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2828	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 2828	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	78
PID 4052 wrote to memory of 2828	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	78
PID 4052 wrote to memory of 2828	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	78
PID 4052 wrote to memory of 2828	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	78
PID 4052 wrote to memory of 2828	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	78
PID 4052 wrote to memory of 200	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	79
PID 4052 wrote to memory of 200	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	79
PID 4052 wrote to memory of 200	4052	60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe	79
PID 2828 wrote to memory of 2292	2828	RegAsm.exe	81
PID 2828 wrote to memory of 2292	2828	RegAsm.exe	81
PID 2828 wrote to memory of 2292	2828	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe
"C:\Users\Admin\AppData\Local\Temp\60e0af6395d28a899bbb2d9b7a61761d9cf1de85ddca77a114dca46054b0e8cd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:2292
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:200

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1516