njrat | 66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7

General

Target
66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe
Size 1.1MB
Sample201114-ejck3nqtvx
SHA256 66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7
MD5 f4121100d025e54af4035ef5b4a44545
SHA1 95b68a95050befbf5159d8d2c66adb9293716c57
SHA512 b72126ad3412d20652ae15ed9daaeb9569abd20d4ecff4fbafc607f04211a6277264e519f1e4315374d30d3443d9067c4c3fd710f46f9417e02fc8f71f74c67a
MD5 SHA1 SHA512

Score

10^/10

njrat redlanhopto evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

redlanhopto

C2

redlan.hopto.org:5553

Mutex

d25d360449d7bab3069e1b77b3a914a3

Attributes

reg_key
d25d360449d7bab3069e1b77b3a914a3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 1 IoCs

pid	Process
1348	data.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 748 set thread context of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00040000000130ff-5.dat	autoit_exe
behavioral1/files/0x00040000000130ff-7.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1244	schtasks.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe
Token: 33	1632	RegAsm.exe
Token: SeIncBasePriorityPrivilege	1632	RegAsm.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1632	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	29
PID 748 wrote to memory of 1244	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	30
PID 748 wrote to memory of 1244	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	30
PID 748 wrote to memory of 1244	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	30
PID 748 wrote to memory of 1244	748	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	30
PID 1632 wrote to memory of 1528	1632	RegAsm.exe	32
PID 1632 wrote to memory of 1528	1632	RegAsm.exe	32
PID 1632 wrote to memory of 1528	1632	RegAsm.exe	32
PID 1632 wrote to memory of 1528	1632	RegAsm.exe	32
PID 856 wrote to memory of 1348	856	taskeng.exe	35
PID 856 wrote to memory of 1348	856	taskeng.exe	35
PID 856 wrote to memory of 1348	856	taskeng.exe	35
PID 856 wrote to memory of 1348	856	taskeng.exe	35

C:\Users\Admin\AppData\Local\Temp\66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe
"C:\Users\Admin\AppData\Local\Temp\66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:1528
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1244

C:\Windows\system32\taskeng.exe
taskeng.exe {5B886B89-66AA-4A3A-AE90-6AD077606F83} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  2⤵
  - Executes dropped EXE
  PID:1348