njrat | aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48

Analysis

max time kernel
151s
max time network
114s
platform
windows7_x64
resource
win7v20201028
submitted
10/11/2020, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe
Size 1.1MB
Sample201110-tk2kpwbqqn
SHA256 aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48
MD5 0219671eff87fc1cd39875411b58733e
SHA1 9f5cc4d65d96881dd05c7d3e2c1c5b13d07e7899
SHA512 3d1ab2df8ef1fe4cf2264a423c6042bbd9547acab030f536660a0c1a13c76b4569478dae2d158465909643f9e586fc0535f90976b0dddb18f56060c4a2021ecb
MD5 SHA1 SHA512

Score

10^/10

njrat redlanhopto evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

redlanhopto

redlan.hopto.org:5553

Mutex

d25d360449d7bab3069e1b77b3a914a3

Attributes

reg_key
d25d360449d7bab3069e1b77b3a914a3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
932	data.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 932 set thread context of 1476	932	data.exe	36

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00040000000130cc-5.dat	autoit_exe
behavioral1/files/0x00040000000130cc-7.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1952	schtasks.exe
628	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe
Token: 33	1324	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1324	RegAsm.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 1324	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	29
PID 1704 wrote to memory of 628	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	30
PID 1704 wrote to memory of 628	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	30
PID 1704 wrote to memory of 628	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	30
PID 1704 wrote to memory of 628	1704	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	30
PID 1324 wrote to memory of 1584	1324	RegAsm.exe	32
PID 1324 wrote to memory of 1584	1324	RegAsm.exe	32
PID 1324 wrote to memory of 1584	1324	RegAsm.exe	32
PID 1324 wrote to memory of 1584	1324	RegAsm.exe	32
PID 1352 wrote to memory of 932	1352	taskeng.exe	35
PID 1352 wrote to memory of 932	1352	taskeng.exe	35
PID 1352 wrote to memory of 932	1352	taskeng.exe	35
PID 1352 wrote to memory of 932	1352	taskeng.exe	35
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1476	932	data.exe	36
PID 932 wrote to memory of 1952	932	data.exe	37
PID 932 wrote to memory of 1952	932	data.exe	37
PID 932 wrote to memory of 1952	932	data.exe	37
PID 932 wrote to memory of 1952	932	data.exe	37

C:\Users\Admin\AppData\Local\Temp\aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe
"C:\Users\Admin\AppData\Local\Temp\aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:1584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:628

C:\Windows\system32\taskeng.exe
taskeng.exe {0C4D5022-218B-4D7A-A77B-474A6EB9B249} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-0-0x0000000000090000-0x000000000009C000-memory.dmp

Download

memory/1324-2-0x0000000000090000-0x000000000009C000-memory.dmp

Download

memory/1476-8-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/1476-10-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads