njrat | c3eecda765f66631358e23cbb02741b4e2fb2e56c76520d5a83b249ee8f929d8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
22/03/2025, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload.exe
Size

55KB
MD5

2fb0487c62fddc8148bb9c1e7a61ff0b
SHA1

166f462038f8db0cc6462c8f6de5f3098968b7da
SHA256

c3eecda765f66631358e23cbb02741b4e2fb2e56c76520d5a83b249ee8f929d8
SHA512

0fb567a204b6ed8c0104ac893168800fd4f40c3c6bebba1d446c53f5107a6b6bfea5d1d47c77f32efae765c675c976dbd64f541c671f7348100efc4659f42cc9
SSDEEP

1536:kdmIDn/NOryWhI0DGwsNMDmXExI3pmSm:BIDnE+v0DGwsNMDmXExI3pm

Score

10^/10

njrat discovery trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation	Payload.exe

Executes dropped EXE 1 IoCs

pid	Process
4340	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe
Token: 33	4340	dllhost.exe
Token: SeIncBasePriorityPrivilege	4340	dllhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4340	1656	Payload.exe	86
PID 1656 wrote to memory of 4340	1656	Payload.exe	86
PID 1656 wrote to memory of 4340	1656	Payload.exe	86

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\dllhost.exe
  "C:\Users\Admin\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dllhost.exe

Filesize
55KB

MD5
2fb0487c62fddc8148bb9c1e7a61ff0b

SHA1
166f462038f8db0cc6462c8f6de5f3098968b7da

SHA256
c3eecda765f66631358e23cbb02741b4e2fb2e56c76520d5a83b249ee8f929d8

SHA512
0fb567a204b6ed8c0104ac893168800fd4f40c3c6bebba1d446c53f5107a6b6bfea5d1d47c77f32efae765c675c976dbd64f541c671f7348100efc4659f42cc9

Download Submit
memory/1656-0-0x0000000074952000-0x0000000074953000-memory.dmp

Filesize
4KB

Download
memory/1656-1-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1656-2-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/1656-24-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4340-25-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4340-26-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4340-27-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4340-28-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download
memory/4340-29-0x0000000074950000-0x0000000074F01000-memory.dmp

Filesize
5.7MB

Download