njrat | e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8

General

Target
e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe
Size 1.1MB
Sample201111-esdweg8f1x
SHA256 e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8
MD5 b41358828d79c5716e0928581407ca8d
SHA1 5eebda760584bb17cd583cf96f04effa419df8b6
SHA512 0eeebf1badf29bb102503a1c79a2fa58de2de8bd2f8253072217a5cb1b56c499d5ae976678603d3a5b6c3d738b280036b5c6a9a2363a2898622b632d11501cd5
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
676	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4688 set thread context of 3756	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000400000001a4f4-4.dat	autoit_exe
behavioral2/files/0x000400000001a4f4-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2128	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe
Token: 33	3756	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3756	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 3756	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	78
PID 4688 wrote to memory of 3756	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	78
PID 4688 wrote to memory of 3756	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	78
PID 4688 wrote to memory of 3756	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	78
PID 4688 wrote to memory of 3756	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	78
PID 4688 wrote to memory of 2128	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	79
PID 4688 wrote to memory of 2128	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	79
PID 4688 wrote to memory of 2128	4688	e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe	79
PID 3756 wrote to memory of 508	3756	RegAsm.exe	81
PID 3756 wrote to memory of 508	3756	RegAsm.exe	81
PID 3756 wrote to memory of 508	3756	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe
"C:\Users\Admin\AppData\Local\Temp\e9dcefb0b538d04a6da08d747bf640ede1c5de1f39415d5f3cf3742cde92ccb8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:508
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2128