njrat | ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009

Analysis

max time kernel
150s
max time network
65s
platform
windows7_x64
resource
win7v20201028
submitted
15/11/2020, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe
Size 1.1MB
Sample201115-c2ekbgn3d6
SHA256 ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009
MD5 1f50ffd7e17750b0f73b2c577a0e6b1e
SHA1 c261e05ab329516730f88f77e09c6b2d9b7744b6
SHA512 c4db47638b28c404970ab96e5f52b7421907fc4d45334be194b2de0208aee75de8dd1713569b1d60cd23f9b325c011c7a960688716adbc15e7c5ef2ae8432d0f
MD5 SHA1 SHA512

Score

10^/10

njrat redlanhopto evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

redlanhopto

redlan.hopto.org:5553

Mutex

d25d360449d7bab3069e1b77b3a914a3

Attributes

reg_key
d25d360449d7bab3069e1b77b3a914a3
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
1828	data.exe
308	data.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1032 set thread context of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1828 set thread context of 572	1828	data.exe	36

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00040000000130c4-4.dat	autoit_exe
behavioral1/files/0x00040000000130c4-6.dat	autoit_exe
behavioral1/files/0x00040000000130c4-13.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
748	schtasks.exe
1668	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe
Token: 33	612	RegAsm.exe
Token: SeIncBasePriorityPrivilege	612	RegAsm.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 612	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	29
PID 1032 wrote to memory of 1668	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	30
PID 1032 wrote to memory of 1668	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	30
PID 1032 wrote to memory of 1668	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	30
PID 1032 wrote to memory of 1668	1032	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	30
PID 780 wrote to memory of 1828	780	taskeng.exe	33
PID 780 wrote to memory of 1828	780	taskeng.exe	33
PID 780 wrote to memory of 1828	780	taskeng.exe	33
PID 780 wrote to memory of 1828	780	taskeng.exe	33
PID 612 wrote to memory of 1456	612	RegAsm.exe	34
PID 612 wrote to memory of 1456	612	RegAsm.exe	34
PID 612 wrote to memory of 1456	612	RegAsm.exe	34
PID 612 wrote to memory of 1456	612	RegAsm.exe	34
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 572	1828	data.exe	36
PID 1828 wrote to memory of 748	1828	data.exe	37
PID 1828 wrote to memory of 748	1828	data.exe	37
PID 1828 wrote to memory of 748	1828	data.exe	37
PID 1828 wrote to memory of 748	1828	data.exe	37
PID 780 wrote to memory of 308	780	taskeng.exe	39
PID 780 wrote to memory of 308	780	taskeng.exe	39
PID 780 wrote to memory of 308	780	taskeng.exe	39
PID 780 wrote to memory of 308	780	taskeng.exe	39

C:\Users\Admin\AppData\Local\Temp\ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe
"C:\Users\Admin\AppData\Local\Temp\ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:1456
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1668

C:\Windows\system32\taskeng.exe
taskeng.exe {C4E4A3F8-5A44-476F-B59E-00F295858A78} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
    3⤵
    PID:572
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
    3⤵
    - Creates scheduled task(s)
    PID:748
- C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
  2⤵
  - Executes dropped EXE
  PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-8-0x0000000000090000-0x000000000009C000-memory.dmp

Download

memory/572-10-0x0000000000090000-0x000000000009C000-memory.dmp

Download

memory/612-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/612-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads