njrat | ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009

General

Target
ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe
Size 1.1MB
Sample201115-c2ekbgn3d6
SHA256 ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009
MD5 1f50ffd7e17750b0f73b2c577a0e6b1e
SHA1 c261e05ab329516730f88f77e09c6b2d9b7744b6
SHA512 c4db47638b28c404970ab96e5f52b7421907fc4d45334be194b2de0208aee75de8dd1713569b1d60cd23f9b325c011c7a960688716adbc15e7c5ef2ae8432d0f
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 1 IoCs

pid	Process
2120	data.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 224	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	78

autoit_exe 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000500000001a50e-4.dat	autoit_exe
behavioral2/files/0x000500000001a50e-5.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2408	schtasks.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe
Token: 33	224	RegAsm.exe
Token: SeIncBasePriorityPrivilege	224	RegAsm.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 224	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	78
PID 912 wrote to memory of 224	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	78
PID 912 wrote to memory of 224	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	78
PID 912 wrote to memory of 224	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	78
PID 912 wrote to memory of 224	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	78
PID 912 wrote to memory of 2408	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	79
PID 912 wrote to memory of 2408	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	79
PID 912 wrote to memory of 2408	912	ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe	79
PID 224 wrote to memory of 2072	224	RegAsm.exe	81
PID 224 wrote to memory of 2072	224	RegAsm.exe	81
PID 224 wrote to memory of 2072	224	RegAsm.exe	81

C:\Users\Admin\AppData\Local\Temp\ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe
"C:\Users\Admin\AppData\Local\Temp\ffd3401a514ab70fe36ce5f3e25c814a8b9fbf7982f21c6d7bb5f82c82fd2009.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:2072
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2408

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:2120