njrat | 65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c

General

Target
65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe
Size 1.1MB
Sample201114-td42ga2g86
SHA256 65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c
MD5 68164de64f815f6a95606279b10fe404
SHA1 042259a81de86fc21a306e453e2f6e5ac0265666
SHA512 7aeeb06e2e2b589b5397633b5942059df2e1cef5697b88447d8dde1b025761821d6fc91a32ee445f48f9e96a18deeacb3af02a45acb18bc4305bfb11d3d8a752
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 2 IoCs

pid	Process
4028	data.exe
3532	data.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1400 set thread context of 4068	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	79
PID 4028 set thread context of 3856	4028	data.exe	85

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
896	schtasks.exe
1252	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe
Token: 33	4068	RegAsm.exe
Token: SeIncBasePriorityPrivilege	4068	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 4068	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	79
PID 1400 wrote to memory of 4068	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	79
PID 1400 wrote to memory of 4068	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	79
PID 1400 wrote to memory of 4068	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	79
PID 1400 wrote to memory of 4068	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	79
PID 1400 wrote to memory of 896	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	80
PID 1400 wrote to memory of 896	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	80
PID 1400 wrote to memory of 896	1400	65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe	80
PID 4068 wrote to memory of 2228	4068	RegAsm.exe	82
PID 4068 wrote to memory of 2228	4068	RegAsm.exe	82
PID 4068 wrote to memory of 2228	4068	RegAsm.exe	82
PID 4028 wrote to memory of 3856	4028	data.exe	85
PID 4028 wrote to memory of 3856	4028	data.exe	85
PID 4028 wrote to memory of 3856	4028	data.exe	85
PID 4028 wrote to memory of 3856	4028	data.exe	85
PID 4028 wrote to memory of 3856	4028	data.exe	85
PID 4028 wrote to memory of 1252	4028	data.exe	86
PID 4028 wrote to memory of 1252	4028	data.exe	86
PID 4028 wrote to memory of 1252	4028	data.exe	86

C:\Users\Admin\AppData\Local\Temp\65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe
"C:\Users\Admin\AppData\Local\Temp\65dca77996e0dada536e038a8476d8fe229f4ecca6759c36c07ffce0264fa69c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:2228
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:896

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3856
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1252

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:3532