njrat | f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca

General

Target
f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
Size 1009KB
Sample210830-shfhhxeeb6
SHA256 f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca
MD5 48f6e580a94cf841c495afa5c50e96a6
SHA1 e50a3a337524a6a3a638ed33828fda110bbd8d3a
SHA512 3fbef618e474b76feb407b44a892e59c391b09ca6e6c13d589144fe4edee2892101cbf4234075c66d0d2707614c5f4ca5709f0d99459150f1a3fbd66b19abab0
MD5 SHA1 SHA512

Score

10^/10

njrat limebot3 trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Limebot3

C2

microsoftdnsbug.duckdns.org:6699

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
luffy

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
3760	AppVCatalog.exe
2772	AppVCatalog.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 532 set thread context of 2804	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	75
PID 3760 set thread context of 2120	3760	AppVCatalog.exe	82
PID 2772 set thread context of 2808	2772	AppVCatalog.exe	86

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000500000001ab23-123.dat	autoit_exe
behavioral2/files/0x000500000001ab23-124.dat	autoit_exe
behavioral2/files/0x000500000001ab23-134.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2784	schtasks.exe
1552	schtasks.exe
4032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
3760	AppVCatalog.exe
3760	AppVCatalog.exe
3760	AppVCatalog.exe
3760	AppVCatalog.exe
2772	AppVCatalog.exe
2772	AppVCatalog.exe
2772	AppVCatalog.exe
2772	AppVCatalog.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe
Token: 33	2804	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2804	RegAsm.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2804	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	75
PID 532 wrote to memory of 2804	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	75
PID 532 wrote to memory of 2804	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	75
PID 532 wrote to memory of 2804	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	75
PID 532 wrote to memory of 2804	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	75
PID 532 wrote to memory of 2784	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	79
PID 532 wrote to memory of 2784	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	79
PID 532 wrote to memory of 2784	532	f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe	79
PID 3760 wrote to memory of 2120	3760	AppVCatalog.exe	82
PID 3760 wrote to memory of 2120	3760	AppVCatalog.exe	82
PID 3760 wrote to memory of 2120	3760	AppVCatalog.exe	82
PID 3760 wrote to memory of 2120	3760	AppVCatalog.exe	82
PID 3760 wrote to memory of 2120	3760	AppVCatalog.exe	82
PID 3760 wrote to memory of 1552	3760	AppVCatalog.exe	83
PID 3760 wrote to memory of 1552	3760	AppVCatalog.exe	83
PID 3760 wrote to memory of 1552	3760	AppVCatalog.exe	83
PID 2772 wrote to memory of 2808	2772	AppVCatalog.exe	86
PID 2772 wrote to memory of 2808	2772	AppVCatalog.exe	86
PID 2772 wrote to memory of 2808	2772	AppVCatalog.exe	86
PID 2772 wrote to memory of 2808	2772	AppVCatalog.exe	86
PID 2772 wrote to memory of 2808	2772	AppVCatalog.exe	86
PID 2772 wrote to memory of 4032	2772	AppVCatalog.exe	87
PID 2772 wrote to memory of 4032	2772	AppVCatalog.exe	87
PID 2772 wrote to memory of 4032	2772	AppVCatalog.exe	87

C:\Users\Admin\AppData\Local\Temp\f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe
"C:\Users\Admin\AppData\Local\Temp\f44b014fde675419cf4c666a600aa312fccb57be890e12a03b2019d74fe4b1ca.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2784

C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:1552

C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:2808
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-114-0x0000000000E80000-0x0000000000F3D000-memory.dmp

Download

memory/2120-125-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2120-132-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Download

memory/2772-141-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/2804-121-0x0000000000740000-0x000000000088A000-memory.dmp

Download

memory/2804-115-0x0000000000720000-0x000000000073A000-memory.dmp

Download

memory/2808-143-0x00000000015C0000-0x00000000015C1000-memory.dmp

Download

memory/3760-131-0x0000000001140000-0x00000000011EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads