njrat | aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48

General

Target
aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe
Size 1.1MB
Sample201110-tk2kpwbqqn
SHA256 aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48
MD5 0219671eff87fc1cd39875411b58733e
SHA1 9f5cc4d65d96881dd05c7d3e2c1c5b13d07e7899
SHA512 3d1ab2df8ef1fe4cf2264a423c6042bbd9547acab030f536660a0c1a13c76b4569478dae2d158465909643f9e586fc0535f90976b0dddb18f56060c4a2021ecb
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
1056	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4684 set thread context of 3188	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000500000001ab64-4.dat	autoit_exe
behavioral2/files/0x000500000001ab64-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3136	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe
Token: 33	3188	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3188	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3188	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	78
PID 4684 wrote to memory of 3188	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	78
PID 4684 wrote to memory of 3188	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	78
PID 4684 wrote to memory of 3188	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	78
PID 4684 wrote to memory of 3188	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	78
PID 4684 wrote to memory of 3136	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	79
PID 4684 wrote to memory of 3136	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	79
PID 4684 wrote to memory of 3136	4684	aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe	79
PID 3188 wrote to memory of 732	3188	RegAsm.exe	81
PID 3188 wrote to memory of 732	3188	RegAsm.exe	81
PID 3188 wrote to memory of 732	3188	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe
"C:\Users\Admin\AppData\Local\Temp\aa01a5cbb5ef80f3ddb3eb2b14e72dfeb89d3d9ac7bbc344aa90044103e8ed48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:732
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3136

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1056