njrat | 66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7

General

Target
66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe
Size 1.1MB
Sample201114-ejck3nqtvx
SHA256 66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7
MD5 f4121100d025e54af4035ef5b4a44545
SHA1 95b68a95050befbf5159d8d2c66adb9293716c57
SHA512 b72126ad3412d20652ae15ed9daaeb9569abd20d4ecff4fbafc607f04211a6277264e519f1e4315374d30d3443d9067c4c3fd710f46f9417e02fc8f71f74c67a
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
1192	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4772 set thread context of 4148	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000600000001ab59-4.dat	autoit_exe
behavioral2/files/0x000600000001ab59-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
560	schtasks.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe
Token: 33	4148	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4148	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4148	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	78
PID 4772 wrote to memory of 4148	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	78
PID 4772 wrote to memory of 4148	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	78
PID 4772 wrote to memory of 4148	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	78
PID 4772 wrote to memory of 4148	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	78
PID 4772 wrote to memory of 560	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	79
PID 4772 wrote to memory of 560	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	79
PID 4772 wrote to memory of 560	4772	66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe	79
PID 4148 wrote to memory of 904	4148	RegAsm.exe	81
PID 4148 wrote to memory of 904	4148	RegAsm.exe	81
PID 4148 wrote to memory of 904	4148	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe
"C:\Users\Admin\AppData\Local\Temp\66c3433322ecda881ae87166b1be9252d924fe4873da43db08da2b9d90ee25d7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:904
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:560

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1192