njrat | 6df749c99fac5bc1097bdd0566120dbd7f38aa392b06227b66efff14412b80c9

Resubmissions

08/02/2025, 19:56

250208-ynsksaspbm 10

08/02/2025, 19:55

250208-yndrmasngl 10

Analysis

max time kernel
151s
max time network
148s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Everythin.exe
Size

29.5MB
MD5

d83d5ff23292103a65b43fbd42b7f243
SHA1

b27e29d090712a2cf50d17a17fb1a8f78fba8aec
SHA256

6df749c99fac5bc1097bdd0566120dbd7f38aa392b06227b66efff14412b80c9
SHA512

7dc52a8d2eb202603f27cf9addd9c4cc08de289d041b0e4960917354251dae407c9485b864c0d81bad623eda45fa23078205d6e30ac4909c15be3e5961ed35da
SSDEEP

786432:a97LDzYHKsqAK/DxlMwVbrxpstnsnxzxP3LLv:o7LfgOh/TMQ3OnMxtPv

Score

10^/10

njrat stealer windows discovery persistence pyinstaller trojan upx

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Windows

127.0.0.1:10454

Mutex

windows.exe

Attributes

reg_key
windows.exe
splitter
|Ghost|

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

stealer

environmental-seeds.gl.at.ply.gg:35534

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.exe	windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.exe	windows.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.url	windows.exe

Executes dropped EXE 6 IoCs

pid	Process
3000	main.exe
2992	Everything.exe
2768	Everythingnew.exe
2576	main.exe
1204	Process not Found
2220	windows.exe

Loads dropped DLL 4 IoCs

pid	Process
2376	Everythin.exe
3000	main.exe
2576	main.exe
2992	Everything.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows.exe = "\"C:\\ProgramData\\windows.exe\" .."	windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows.exe = "\"C:\\ProgramData\\windows.exe\" .."	windows.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000195c6-46.dat	upx

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0009000000016d70-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everythingnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1932	TASKKILL.exe
2160	TASKKILL.exe
1896	TASKKILL.exe
2444	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1800	schtasks.exe
1748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe
2992	Everything.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	2992	Everything.exe
Token: SeDebugPrivilege	2160	TASKKILL.exe
Token: SeDebugPrivilege	1932	TASKKILL.exe
Token: SeDebugPrivilege	2220	windows.exe
Token: SeDebugPrivilege	2444	TASKKILL.exe
Token: SeDebugPrivilege	1896	TASKKILL.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe
Token: 33	2220	windows.exe
Token: SeIncBasePriorityPrivilege	2220	windows.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 3000	2376	Everythin.exe	29
PID 2376 wrote to memory of 3000	2376	Everythin.exe	29
PID 2376 wrote to memory of 3000	2376	Everythin.exe	29
PID 2376 wrote to memory of 2992	2376	Everythin.exe	30
PID 2376 wrote to memory of 2992	2376	Everythin.exe	30
PID 2376 wrote to memory of 2992	2376	Everythin.exe	30
PID 2376 wrote to memory of 2992	2376	Everythin.exe	30
PID 2376 wrote to memory of 2768	2376	Everythin.exe	31
PID 2376 wrote to memory of 2768	2376	Everythin.exe	31
PID 2376 wrote to memory of 2768	2376	Everythin.exe	31
PID 2376 wrote to memory of 2768	2376	Everythin.exe	31
PID 3000 wrote to memory of 2576	3000	main.exe	32
PID 3000 wrote to memory of 2576	3000	main.exe	32
PID 3000 wrote to memory of 2576	3000	main.exe	32
PID 2992 wrote to memory of 1932	2992	Everything.exe	33
PID 2992 wrote to memory of 1932	2992	Everything.exe	33
PID 2992 wrote to memory of 1932	2992	Everything.exe	33
PID 2992 wrote to memory of 1932	2992	Everything.exe	33
PID 2992 wrote to memory of 2160	2992	Everything.exe	35
PID 2992 wrote to memory of 2160	2992	Everything.exe	35
PID 2992 wrote to memory of 2160	2992	Everything.exe	35
PID 2992 wrote to memory of 2160	2992	Everything.exe	35
PID 2992 wrote to memory of 1800	2992	Everything.exe	38
PID 2992 wrote to memory of 1800	2992	Everything.exe	38
PID 2992 wrote to memory of 1800	2992	Everything.exe	38
PID 2992 wrote to memory of 1800	2992	Everything.exe	38
PID 2992 wrote to memory of 2220	2992	Everything.exe	40
PID 2992 wrote to memory of 2220	2992	Everything.exe	40
PID 2992 wrote to memory of 2220	2992	Everything.exe	40
PID 2992 wrote to memory of 2220	2992	Everything.exe	40
PID 2992 wrote to memory of 1528	2992	Everything.exe	41
PID 2992 wrote to memory of 1528	2992	Everything.exe	41
PID 2992 wrote to memory of 1528	2992	Everything.exe	41
PID 2992 wrote to memory of 1528	2992	Everything.exe	41
PID 2220 wrote to memory of 1896	2220	windows.exe	42
PID 2220 wrote to memory of 1896	2220	windows.exe	42
PID 2220 wrote to memory of 1896	2220	windows.exe	42
PID 2220 wrote to memory of 1896	2220	windows.exe	42
PID 2220 wrote to memory of 2444	2220	windows.exe	43
PID 2220 wrote to memory of 2444	2220	windows.exe	43
PID 2220 wrote to memory of 2444	2220	windows.exe	43
PID 2220 wrote to memory of 2444	2220	windows.exe	43
PID 2220 wrote to memory of 1748	2220	windows.exe	47
PID 2220 wrote to memory of 1748	2220	windows.exe	47
PID 2220 wrote to memory of 1748	2220	windows.exe	47
PID 2220 wrote to memory of 1748	2220	windows.exe	47

C:\Users\Admin\AppData\Local\Temp\Everythin.exe
"C:\Users\Admin\AppData\Local\Temp\Everythin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2576
- C:\Users\Admin\AppData\Local\Temp\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\Everything.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc onstart /mo 1 /tn nyan /tr C:\ProgramData\windows.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- - C:\ProgramData\windows.exe
    "C:\ProgramData\windows.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1896
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2444
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc onstart /mo 1 /tn nyan /tr C:\ProgramData\windows.exe
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Everything.exe"
    3⤵
    PID:1528
- C:\Users\Admin\AppData\Local\Temp\Everythingnew.exe
  "C:\Users\Admin\AppData\Local\Temp\Everythingnew.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Everything.exe

Filesize
106KB

MD5
060317250cfe7e96901acc7c27a84bc7

SHA1
0e85789e56309e5832dc7d2be081bd4193373ee7

SHA256
d55ef4b76f8250026b20d9c61eb191f9078ff75b846f0d26b29b01c02cd24d35

SHA512
7bbba13add3f69f5a18db2cb9df91725be607bc019c507a2e8feb4e6b45375261dae761682bcb481e5b2cb8e5a245e67c77318c1ff2654df6b7d82dc0532d27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Everythingnew.exe

Filesize
43KB

MD5
e6c670a90c4eb92933de49b9b28d19bc

SHA1
e561d4517df4a7bdf2fafdf4f5dafabedc3c74e0

SHA256
f09c8a7cfd0dbbafc4191ecf15e57329fd1959b6b4da2bcac0ab59f08b8db009

SHA512
552ad265eb09afa523f3ec3fa22300b47630064db6788c97e16051352d55c45cb6a7ca21f01e31246aad391f571adab7e89e567264a9c0a9cf87c8208a60f398

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI30002\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
\Users\Admin\AppData\Local\Temp\main.exe

Filesize
29.2MB

MD5
c7605aa6808be099dcd48d800545fa6b

SHA1
390b339baa457cbea092497c1d78b998837aef3a

SHA256
c1a214fc8ac61274a856d776a69904aeddb2876f0ee9b1868d7f93350e0b6f52

SHA512
a508264c5c051a2e2df8d311a334c3c43bd1355ab40f9079a9433d28e8bbfc1be628dfc1cfc35efe0f1ef749dcd9bb2e1934466e7af1b36725636c6bfbf9a880

Download Submit
memory/2220-83-0x0000000000D10000-0x0000000000D30000-memory.dmp

Filesize
128KB

Download
memory/2576-51-0x000007FEF5DF0000-0x000007FEF6455000-memory.dmp

Filesize
6.4MB

Download
memory/2768-47-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/2768-50-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2768-52-0x0000000074370000-0x0000000074A5E000-memory.dmp

Filesize
6.9MB

Download
memory/2992-43-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download
memory/2992-44-0x0000000000160000-0x0000000000180000-memory.dmp

Filesize
128KB

Download
memory/2992-75-0x000000007437E000-0x000000007437F000-memory.dmp

Filesize
4KB

Download