njrat | 8bc1e289657c8d1bbbc902bd0315dc20ae52a58cd045bfff5a550fab62ef56f2

General

Target
380612e3c280b4e811c19e95274b1015.exe
Size 1.1MB
Sample201117-wsrrjyc8j2
SHA256 8bc1e289657c8d1bbbc902bd0315dc20ae52a58cd045bfff5a550fab62ef56f2
MD5 fcaef837ccfe63416a2d9790e62981b2
SHA1 371d47bf1c08c6143464f211fc560e6c5f10ed93
SHA512 cb9ffc38c331d157f6665aca69d6daac9d129fd0ea5927633a461255e3cdf53e65a5d361a3b2a29a35f680ce42f4ae62d060d3360b659f2b44c52c2f364b4b17
MD5 SHA1 SHA512

Score

10^/10

Family

Version

Botnet

C2

Mutex

Attributes

Executes dropped EXE 2 IoCs

pid	Process
3104	data.exe
1276	data.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 3608	508	380612e3c280b4e811c19e95274b1015.exe	78
PID 3104 set thread context of 4040	3104	data.exe	84

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
2664	schtasks.exe
2444	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe
Token: 33	3608	RegAsm.exe
Token: SeIncBasePriorityPrivilege	3608	RegAsm.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 3608	508	380612e3c280b4e811c19e95274b1015.exe	78
PID 508 wrote to memory of 3608	508	380612e3c280b4e811c19e95274b1015.exe	78
PID 508 wrote to memory of 3608	508	380612e3c280b4e811c19e95274b1015.exe	78
PID 508 wrote to memory of 3608	508	380612e3c280b4e811c19e95274b1015.exe	78
PID 508 wrote to memory of 3608	508	380612e3c280b4e811c19e95274b1015.exe	78
PID 508 wrote to memory of 2664	508	380612e3c280b4e811c19e95274b1015.exe	79
PID 508 wrote to memory of 2664	508	380612e3c280b4e811c19e95274b1015.exe	79
PID 508 wrote to memory of 2664	508	380612e3c280b4e811c19e95274b1015.exe	79
PID 3608 wrote to memory of 748	3608	RegAsm.exe	81
PID 3608 wrote to memory of 748	3608	RegAsm.exe	81
PID 3608 wrote to memory of 748	3608	RegAsm.exe	81
PID 3104 wrote to memory of 4040	3104	data.exe	84
PID 3104 wrote to memory of 4040	3104	data.exe	84
PID 3104 wrote to memory of 4040	3104	data.exe	84
PID 3104 wrote to memory of 4040	3104	data.exe	84
PID 3104 wrote to memory of 4040	3104	data.exe	84
PID 3104 wrote to memory of 2444	3104	data.exe	85
PID 3104 wrote to memory of 2444	3104	data.exe	85
PID 3104 wrote to memory of 2444	3104	data.exe	85

C:\Users\Admin\AppData\Local\Temp\380612e3c280b4e811c19e95274b1015.exe
"C:\Users\Admin\AppData\Local\Temp\380612e3c280b4e811c19e95274b1015.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
    3⤵
    PID:748
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2664

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4040
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2444

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe
1⤵
- Executes dropped EXE
PID:1276