Overview

overview

10

Static

static

Cirular-18...ar.exe

windows7_x64

10

Cirular-18...ar.exe

windows10_x64

10

Cirular-18...oc.lnk

windows7_x64

10

Cirular-18...oc.lnk

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 23:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Cirular-18April2017/Circular.Doc.lnk

  • Size

    1KB

  • MD5

    f0093f6cb0dec239c81d9946380ea172

  • SHA1

    56a49a4d52b6f7fc94623c769df2aaf1b46f4c42

  • SHA256

    7818dd357bd780aae737e94f8f57b5b2cb643ceca8cc044c866d31d953ed3621

  • SHA512

    1af3a27846ee084941e4511500a6bfea5f51f97d9868e4f87711dc717a4651bde664d9ef234c2602b4def28522694a52ddc9ed6c259985a41936dac79e0f1ba2

Score
10/10
njratevasiontrojan

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Cirular-18April2017\Circular.Doc.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3720
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Circular.Doc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Users\Admin\AppData\Local\Temp\Cirular-18April2017\Circular.Doc
        Circular.Doc
        3⤵
        • Drops startup file
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4080
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE
            5⤵
              PID:4208

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Modify Existing Service

    1
    T1031

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4016-115-0x00000000011C0000-0x00000000011C1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4016-116-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4016-118-0x0000000006020000-0x0000000006164000-memory.dmp
      Filesize

      1.3MB

      Download
    • memory/4080-119-0x0000000002300000-0x0000000002301000-memory.dmp
      Filesize

      4KB

      Download