njrat | c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf

General

Target
c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
Size 1009KB
Sample210831-ads4qphsb2
SHA256 c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf
MD5 58ad9622adf709180ce51c9ec8fb2091
SHA1 5faf87bff2c9a2255328b934d0da4427239459ec
SHA512 1875379f37b8b1a4ebe935bd1f2eb0b47214d2e38da69bdace31b055008992154d237fb6c1ccb9e2a898ed77ba8da3b22a3dc7831daf9b05d585c5541c097304
MD5 SHA1 SHA512

Score

10^/10

njrat limebot3 trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Limebot3

C2

microsoftdnsbug.duckdns.org:6699

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
luffy

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
788	AppVCatalog.exe
2340	AppVCatalog.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 856 set thread context of 2952	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	75
PID 788 set thread context of 1116	788	AppVCatalog.exe	82
PID 2340 set thread context of 3872	2340	AppVCatalog.exe	86

autoit_exe 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000001ab41-123.dat	autoit_exe
behavioral2/files/0x000100000001ab41-124.dat	autoit_exe
behavioral2/files/0x000100000001ab41-134.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2236	schtasks.exe
2192	schtasks.exe
3236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
788	AppVCatalog.exe
788	AppVCatalog.exe
788	AppVCatalog.exe
788	AppVCatalog.exe
2340	AppVCatalog.exe
2340	AppVCatalog.exe
2340	AppVCatalog.exe
2340	AppVCatalog.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe
Token: 33	2952	RegAsm.exe
Token: SeIncBasePriorityPrivilege	2952	RegAsm.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2952	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	75
PID 856 wrote to memory of 2952	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	75
PID 856 wrote to memory of 2952	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	75
PID 856 wrote to memory of 2952	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	75
PID 856 wrote to memory of 2952	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	75
PID 856 wrote to memory of 2236	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	79
PID 856 wrote to memory of 2236	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	79
PID 856 wrote to memory of 2236	856	c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe	79
PID 788 wrote to memory of 1116	788	AppVCatalog.exe	82
PID 788 wrote to memory of 1116	788	AppVCatalog.exe	82
PID 788 wrote to memory of 1116	788	AppVCatalog.exe	82
PID 788 wrote to memory of 1116	788	AppVCatalog.exe	82
PID 788 wrote to memory of 1116	788	AppVCatalog.exe	82
PID 788 wrote to memory of 2192	788	AppVCatalog.exe	83
PID 788 wrote to memory of 2192	788	AppVCatalog.exe	83
PID 788 wrote to memory of 2192	788	AppVCatalog.exe	83
PID 2340 wrote to memory of 3872	2340	AppVCatalog.exe	86
PID 2340 wrote to memory of 3872	2340	AppVCatalog.exe	86
PID 2340 wrote to memory of 3872	2340	AppVCatalog.exe	86
PID 2340 wrote to memory of 3872	2340	AppVCatalog.exe	86
PID 2340 wrote to memory of 3872	2340	AppVCatalog.exe	86
PID 2340 wrote to memory of 3236	2340	AppVCatalog.exe	87
PID 2340 wrote to memory of 3236	2340	AppVCatalog.exe	87
PID 2340 wrote to memory of 3236	2340	AppVCatalog.exe	87

C:\Users\Admin\AppData\Local\Temp\c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe
"C:\Users\Admin\AppData\Local\Temp\c15e0fc3aff8a87c89fa2d77dcef23fb0a532d28781ff1eeb7bce5e4cce4dfdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2236

C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:1116
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2192

C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3872
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn PnPUnattend /tr "C:\Users\Admin\CapabilityAccessHandlers\AppVCatalog.exe" /sc minute /mo 1 /F
  2⤵
  - Creates scheduled task(s)
  PID:3236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-131-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/856-120-0x0000000000C00000-0x0000000000D4A000-memory.dmp

Download

memory/1116-132-0x00000000026C0000-0x00000000026C1000-memory.dmp

Download

memory/2952-114-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2952-121-0x00000000027B0000-0x00000000027B1000-memory.dmp

Download

memory/3872-135-0x0000000000770000-0x000000000078A000-memory.dmp

Download

memory/3872-142-0x00000000007C0000-0x000000000086E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads