njrat | cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864

General

Target
cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe
Size 1.1MB
Sample201114-fb91kzg8be
SHA256 cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864
MD5 78fe8097d78bf46836ebdebb96477d93
SHA1 d5f40066bb7e1b603d4947dbe83784c0d69fe1f5
SHA512 fdfdc073ad9c01854dff77158dd73253e14e906e181af3189795bc5351aefc5322e028633778850b6ac98a26b8b5100dd144c2a5e6041ea45ea6636a64c67476
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
2056	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 636 set thread context of 3664	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000500000001ab92-4.dat	autoit_exe
behavioral2/files/0x000500000001ab92-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3800	schtasks.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe
Token: 33	3664	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3664	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3664	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	78
PID 636 wrote to memory of 3664	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	78
PID 636 wrote to memory of 3664	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	78
PID 636 wrote to memory of 3664	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	78
PID 636 wrote to memory of 3664	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	78
PID 636 wrote to memory of 3800	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	79
PID 636 wrote to memory of 3800	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	79
PID 636 wrote to memory of 3800	636	cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe	79
PID 3664 wrote to memory of 4020	3664	RegAsm.exe	81
PID 3664 wrote to memory of 4020	3664	RegAsm.exe	81
PID 3664 wrote to memory of 4020	3664	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe
"C:\Users\Admin\AppData\Local\Temp\cd7951f7292506e314834d7c82e290f84a9f55ba2feac4fa4ef545d9cbf79864.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:4020
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3800

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:2056