njrat | 707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209

General

Target
707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe
Size 1.1MB
Sample201114-2dszqzk6vx
SHA256 707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209
MD5 8ca7c848c7cfaccea5b90146be8ceef5
SHA1 4dc241286c572a40d8351025013d820d54201e7c
SHA512 eaf80a71afc5d89d1f152f4caa89b847820a888a4f1c26e34b6e803144b72543ac35e066dc13afbeedcd8a736052f0ee425fc0f13be256d04d1e6e3f2af03a5d
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
1280	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1812 set thread context of 3744	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000400000001ab6c-4.dat	autoit_exe
behavioral2/files/0x000400000001ab6c-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3344	schtasks.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe
Token: 33	3744	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3744	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3744	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	78
PID 1812 wrote to memory of 3744	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	78
PID 1812 wrote to memory of 3744	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	78
PID 1812 wrote to memory of 3744	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	78
PID 1812 wrote to memory of 3744	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	78
PID 1812 wrote to memory of 3344	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	79
PID 1812 wrote to memory of 3344	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	79
PID 1812 wrote to memory of 3344	1812	707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe	79
PID 3744 wrote to memory of 3052	3744	RegAsm.exe	81
PID 3744 wrote to memory of 3052	3744	RegAsm.exe	81
PID 3744 wrote to memory of 3052	3744	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe
"C:\Users\Admin\AppData\Local\Temp\707d2a9dc17cfe0734dc3ef46a4e7761d8c873de5496243b7b435ac3c9c0b209.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:3052
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3344

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1280