njrat | d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7

General

Target
d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe
Size 1.1MB
Sample201111-jx3ftfm35a
SHA256 d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7
MD5 ddfe53f869d21e505303b2807e30ea05
SHA1 2ccfbd467dc5115652f82a4fc08432068fdab70e
SHA512 871a12ecdab6d61a3d356b65c23efbb229453cf0046e73c9a4869abbb89ca7238408292d5630354e1929a67df8d6004044878ecda5954bb7c95d4b27d7d05a4a
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
3992	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 3096	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000400000001a50e-4.dat	autoit_exe
behavioral2/files/0x000400000001a50e-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1984	schtasks.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe
Token: 33	3096	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3096	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3096	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	78
PID 4040 wrote to memory of 3096	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	78
PID 4040 wrote to memory of 3096	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	78
PID 4040 wrote to memory of 3096	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	78
PID 4040 wrote to memory of 3096	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	78
PID 4040 wrote to memory of 1984	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	79
PID 4040 wrote to memory of 1984	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	79
PID 4040 wrote to memory of 1984	4040	d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe	79
PID 3096 wrote to memory of 3620	3096	RegAsm.exe	81
PID 3096 wrote to memory of 3620	3096	RegAsm.exe	81
PID 3096 wrote to memory of 3620	3096	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe
"C:\Users\Admin\AppData\Local\Temp\d96653a7c3710d58e3e09d36dafa724694a7eabba01ded12850a4e1ea6f645c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:3620
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1984

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:3992