Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 23:50
General
-
Target
Cirular-18April2017/Circular.Doc.lnk
-
Size
1KB
-
MD5
f0093f6cb0dec239c81d9946380ea172
-
SHA1
56a49a4d52b6f7fc94623c769df2aaf1b46f4c42
-
SHA256
7818dd357bd780aae737e94f8f57b5b2cb643ceca8cc044c866d31d953ed3621
-
SHA512
1af3a27846ee084941e4511500a6bfea5f51f97d9868e4f87711dc717a4651bde664d9ef234c2602b4def28522694a52ddc9ed6c259985a41936dac79e0f1ba2
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
zalupa180417
C2
808080.ddns.net:5555
Mutex
4cb72bb7475074f5af41f3e5e189ee3f
Attributes
-
reg_key
4cb72bb7475074f5af41f3e5e189ee3f
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 34 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Cirular-18April2017\Circular.Doc.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Circular.Doc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cirular-18April2017\Circular.DocCircular.Doc3⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE5⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
896KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
4KB