njrat | 40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
07/10/2025, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Size 31KB
Sample251007-l8nfca1xfs
SHA256 40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d
MD5 b680f078f606059f3f7ddb5b7cff1121
SHA1 cbb3e7d4d9450fffc08fd3cf0e4ff54db1d41e68
SHA512 da953b8bb401463a9b4adbe4221404cfb2109061c94f464b76594dfc589869f50daae31ece9f242960aced01bd31874218b6f2de76432803692ac47b01ebb9f7
SSDEEP 768:Vfd6hcp9P3SzxdupgDBTrV1DvTDQmIDUu0tiKwj:ShQ6fpnQVkqj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3628	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: 33	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
Token: SeIncBasePriorityPrivilege	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3628	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe	78
PID 2712 wrote to memory of 3628	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe	78
PID 2712 wrote to memory of 3628	2712	40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe	78

C:\Users\Admin\AppData\Local\Temp\40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe
"C:\Users\Admin\AppData\Local\Temp\40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe" "40ad87dfeed9d6d5190e9a78e285d02e28562028eefcdb25595c90d53faed60d.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3628