njrat | e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8

General

Target
e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe
Size 1.1MB
Sample201111-esdweg8f1x
SHA256 e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8
MD5 b41358828d79c5716e0928581407ca8d
SHA1 5eebda760584bb17cd583cf96f04effa419df8b6
SHA512 0eeebf1badf29bb102503a1c79a2fa58de2de8bd2f8253072217a5cb1b56c499d5ae976678603d3a5b6c3d738b280036b5c6a9a2363a2898622b632d11501cd5
MD5 SHA1 SHA512

Score

10^/10

njrat redlanhopto evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

redlanhopto

C2

redlan.hopto.org:5553

Mutex

d25d360449d7bab3069e1b77b3a914a3

Attributes

reg_key
d25d360449d7bab3069e1b77b3a914a3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
608	data.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 300 set thread context of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00040000000130e3-5.dat	autoit_exe
behavioral1/files/0x00040000000130e3-7.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1140	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe
Token: 33	1672	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1672	RegAsm.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1672	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	29
PID 300 wrote to memory of 1140	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	30
PID 300 wrote to memory of 1140	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	30
PID 300 wrote to memory of 1140	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	30
PID 300 wrote to memory of 1140	300	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	30
PID 1672 wrote to memory of 1380	1672	RegAsm.exe	32
PID 1672 wrote to memory of 1380	1672	RegAsm.exe	32
PID 1672 wrote to memory of 1380	1672	RegAsm.exe	32
PID 1672 wrote to memory of 1380	1672	RegAsm.exe	32
PID 544 wrote to memory of 608	544	taskeng.exe	35
PID 544 wrote to memory of 608	544	taskeng.exe	35
PID 544 wrote to memory of 608	544	taskeng.exe	35
PID 544 wrote to memory of 608	544	taskeng.exe	35

C:\Users\Admin\AppData\Local\Temp\e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe
"C:\Users\Admin\AppData\Local\Temp\e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:300
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:1380
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1140

C:\Windows\system32\taskeng.exe
taskeng.exe {B885DA56-5D59-4168-8D7E-36AAC5191D4B} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:544
- C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  2⤵
  - Executes dropped EXE
  PID:608