njrat | 6df749c99fac5bc1097bdd0566120dbd7f38aa392b06227b66efff14412b80c9

Analysis

max time kernel
61s
max time network
68s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
08/02/2025, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Everythin.exe
Size

29.5MB
MD5

d83d5ff23292103a65b43fbd42b7f243
SHA1

b27e29d090712a2cf50d17a17fb1a8f78fba8aec
SHA256

6df749c99fac5bc1097bdd0566120dbd7f38aa392b06227b66efff14412b80c9
SHA512

7dc52a8d2eb202603f27cf9addd9c4cc08de289d041b0e4960917354251dae407c9485b864c0d81bad623eda45fa23078205d6e30ac4909c15be3e5961ed35da
SSDEEP

786432:a97LDzYHKsqAK/DxlMwVbrxpstnsnxzxP3LLv:o7LfgOh/TMQ3OnMxtPv

Score

10^/10

njrat stealer windows discovery persistence pyinstaller trojan upx

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

stealer

environmental-seeds.gl.at.ply.gg:35534

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Extracted

Family

njrat

Version

Platinum

Botnet

Windows

127.0.0.1:10454

Mutex

windows.exe

Attributes

reg_key
windows.exe
splitter
|Ghost|

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.exe	windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.exe	windows.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.url	windows.exe

Executes dropped EXE 6 IoCs

pid	Process
2956	main.exe
1380	main.exe
2880	Everything.exe
828	Everythingnew.exe
1188	Process not Found
2648	windows.exe

Loads dropped DLL 4 IoCs

pid	Process
2424	Everythin.exe
2956	main.exe
1380	main.exe
2880	Everything.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows.exe = "\"C:\\ProgramData\\windows.exe\" .."	windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\windows.exe = "\"C:\\ProgramData\\windows.exe\" .."	windows.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001960c-41.dat	upx
behavioral1/memory/1380-44-0x000007FEF6A60000-0x000007FEF70C5000-memory.dmp	upx
behavioral1/memory/1380-63-0x000007FEF6A60000-0x000007FEF70C5000-memory.dmp	upx

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000800000001756e-7.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everythingnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2484	cmd.exe
1480	PING.EXE

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1756	TASKKILL.exe
2092	TASKKILL.exe
964	TASKKILL.exe
1616	TASKKILL.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1480	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe
2404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe
2880	Everything.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	Everything.exe
Token: SeDebugPrivilege	964	TASKKILL.exe
Token: SeDebugPrivilege	2092	TASKKILL.exe
Token: SeDebugPrivilege	2648	windows.exe
Token: SeDebugPrivilege	1756	TASKKILL.exe
Token: SeDebugPrivilege	1616	TASKKILL.exe
Token: 33	2648	windows.exe
Token: SeIncBasePriorityPrivilege	2648	windows.exe
Token: 33	2648	windows.exe
Token: SeIncBasePriorityPrivilege	2648	windows.exe
Token: 33	2648	windows.exe
Token: SeIncBasePriorityPrivilege	2648	windows.exe
Token: 33	2648	windows.exe
Token: SeIncBasePriorityPrivilege	2648	windows.exe
Token: 33	2648	windows.exe
Token: SeIncBasePriorityPrivilege	2648	windows.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2956	2424	Everythin.exe	29
PID 2424 wrote to memory of 2956	2424	Everythin.exe	29
PID 2424 wrote to memory of 2956	2424	Everythin.exe	29
PID 2424 wrote to memory of 2880	2424	Everythin.exe	30
PID 2424 wrote to memory of 2880	2424	Everythin.exe	30
PID 2424 wrote to memory of 2880	2424	Everythin.exe	30
PID 2424 wrote to memory of 2880	2424	Everythin.exe	30
PID 2956 wrote to memory of 1380	2956	main.exe	31
PID 2956 wrote to memory of 1380	2956	main.exe	31
PID 2956 wrote to memory of 1380	2956	main.exe	31
PID 2424 wrote to memory of 828	2424	Everythin.exe	32
PID 2424 wrote to memory of 828	2424	Everythin.exe	32
PID 2424 wrote to memory of 828	2424	Everythin.exe	32
PID 2424 wrote to memory of 828	2424	Everythin.exe	32
PID 2880 wrote to memory of 2092	2880	Everything.exe	33
PID 2880 wrote to memory of 2092	2880	Everything.exe	33
PID 2880 wrote to memory of 2092	2880	Everything.exe	33
PID 2880 wrote to memory of 2092	2880	Everything.exe	33
PID 2880 wrote to memory of 964	2880	Everything.exe	35
PID 2880 wrote to memory of 964	2880	Everything.exe	35
PID 2880 wrote to memory of 964	2880	Everything.exe	35
PID 2880 wrote to memory of 964	2880	Everything.exe	35
PID 2880 wrote to memory of 2604	2880	Everything.exe	38
PID 2880 wrote to memory of 2604	2880	Everything.exe	38
PID 2880 wrote to memory of 2604	2880	Everything.exe	38
PID 2880 wrote to memory of 2604	2880	Everything.exe	38
PID 2880 wrote to memory of 2648	2880	Everything.exe	40
PID 2880 wrote to memory of 2648	2880	Everything.exe	40
PID 2880 wrote to memory of 2648	2880	Everything.exe	40
PID 2880 wrote to memory of 2648	2880	Everything.exe	40
PID 2880 wrote to memory of 3036	2880	Everything.exe	41
PID 2880 wrote to memory of 3036	2880	Everything.exe	41
PID 2880 wrote to memory of 3036	2880	Everything.exe	41
PID 2880 wrote to memory of 3036	2880	Everything.exe	41
PID 2648 wrote to memory of 1616	2648	windows.exe	43
PID 2648 wrote to memory of 1616	2648	windows.exe	43
PID 2648 wrote to memory of 1616	2648	windows.exe	43
PID 2648 wrote to memory of 1616	2648	windows.exe	43
PID 2648 wrote to memory of 1756	2648	windows.exe	44
PID 2648 wrote to memory of 1756	2648	windows.exe	44
PID 2648 wrote to memory of 1756	2648	windows.exe	44
PID 2648 wrote to memory of 1756	2648	windows.exe	44
PID 2648 wrote to memory of 2404	2648	windows.exe	48
PID 2648 wrote to memory of 2404	2648	windows.exe	48
PID 2648 wrote to memory of 2404	2648	windows.exe	48
PID 2648 wrote to memory of 2404	2648	windows.exe	48
PID 2648 wrote to memory of 2484	2648	windows.exe	50
PID 2648 wrote to memory of 2484	2648	windows.exe	50
PID 2648 wrote to memory of 2484	2648	windows.exe	50
PID 2648 wrote to memory of 2484	2648	windows.exe	50
PID 2484 wrote to memory of 1480	2484	cmd.exe	52
PID 2484 wrote to memory of 1480	2484	cmd.exe	52
PID 2484 wrote to memory of 1480	2484	cmd.exe	52
PID 2484 wrote to memory of 1480	2484	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\Everythin.exe
"C:\Users\Admin\AppData\Local\Temp\Everythin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\main.exe
  "C:\Users\Admin\AppData\Local\Temp\main.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\main.exe
    "C:\Users\Admin\AppData\Local\Temp\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1380
- C:\Users\Admin\AppData\Local\Temp\Everything.exe
  "C:\Users\Admin\AppData\Local\Temp\Everything.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM wscript.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2092
- - C:\Windows\SysWOW64\TASKKILL.exe
    TASKKILL /F /IM cmd.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc onstart /mo 1 /tn nyan /tr C:\ProgramData\windows.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- - C:\ProgramData\windows.exe
    "C:\ProgramData\windows.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM wscript.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1616
  - - C:\Windows\SysWOW64\TASKKILL.exe
      TASKKILL /F /IM cmd.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1756
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc onstart /mo 1 /tn nyan /tr C:\ProgramData\windows.exe
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 0 -n 2 & del "C:\ProgramData\windows.exe"
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:2484
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 0 -n 2
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Everything.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3036
  - - C:\Windows\SysWOW64\choice.exe
      choice /C Y /N /D Y /T 5
      4⤵
      PID:2156
- C:\Users\Admin\AppData\Local\Temp\Everythingnew.exe
  "C:\Users\Admin\AppData\Local\Temp\Everythingnew.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Everything.exe

Filesize
106KB

MD5
060317250cfe7e96901acc7c27a84bc7

SHA1
0e85789e56309e5832dc7d2be081bd4193373ee7

SHA256
d55ef4b76f8250026b20d9c61eb191f9078ff75b846f0d26b29b01c02cd24d35

SHA512
7bbba13add3f69f5a18db2cb9df91725be607bc019c507a2e8feb4e6b45375261dae761682bcb481e5b2cb8e5a245e67c77318c1ff2654df6b7d82dc0532d27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Everythingnew.exe

Filesize
43KB

MD5
e6c670a90c4eb92933de49b9b28d19bc

SHA1
e561d4517df4a7bdf2fafdf4f5dafabedc3c74e0

SHA256
f09c8a7cfd0dbbafc4191ecf15e57329fd1959b6b4da2bcac0ab59f08b8db009

SHA512
552ad265eb09afa523f3ec3fa22300b47630064db6788c97e16051352d55c45cb6a7ca21f01e31246aad391f571adab7e89e567264a9c0a9cf87c8208a60f398

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29562\python313.dll

Filesize
1.8MB

MD5
9a3d3ae5745a79d276b05a85aea02549

SHA1
a5e60cac2ca606df4f7646d052a9c0ea813e7636

SHA256
09693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889

SHA512
46840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69

Download Submit
\Users\Admin\AppData\Local\Temp\main.exe

Filesize
29.2MB

MD5
c7605aa6808be099dcd48d800545fa6b

SHA1
390b339baa457cbea092497c1d78b998837aef3a

SHA256
c1a214fc8ac61274a856d776a69904aeddb2876f0ee9b1868d7f93350e0b6f52

SHA512
a508264c5c051a2e2df8d311a334c3c43bd1355ab40f9079a9433d28e8bbfc1be628dfc1cfc35efe0f1ef749dcd9bb2e1934466e7af1b36725636c6bfbf9a880

Download Submit
memory/828-49-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

Filesize
72KB

Download
memory/828-47-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/1380-63-0x000007FEF6A60000-0x000007FEF70C5000-memory.dmp

Filesize
6.4MB

Download
memory/1380-44-0x000007FEF6A60000-0x000007FEF70C5000-memory.dmp

Filesize
6.4MB

Download
memory/2648-83-0x0000000000DC0000-0x0000000000DE0000-memory.dmp

Filesize
128KB

Download
memory/2880-50-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-48-0x0000000001170000-0x0000000001190000-memory.dmp

Filesize
128KB

Download
memory/2880-75-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-84-0x00000000748B0000-0x0000000074F9E000-memory.dmp

Filesize
6.9MB

Download