njrat | 01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2025, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Size 30KB
Sample251007-n3d1tscn3w
SHA256 01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783
MD5 01ab43dd12bceb95c6ea9ee3a829eedb
SHA1 8f31b34c55a0935f422ded68cabd22a21ad8a344
SHA512 eb79376315212f8543b5d452323204f2dfdf5f0515ef62dd2ad42e32934d3817e2e23a36f25d4684da0935e5fbf63c4feeb848a976dbf7b29fb82d188f6c10d1
SSDEEP 768:akjJbSvdG1XB9Qzxry1GC5oP7jCbxvYF3QmIDUu0tiKmj:Bj6dm6hCPxC3QVkIj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5716	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: 33	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
Token: SeIncBasePriorityPrivilege	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 5716	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe	85
PID 5572 wrote to memory of 5716	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe	85
PID 5572 wrote to memory of 5716	5572	01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe	85

C:\Users\Admin\AppData\Local\Temp\01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe
"C:\Users\Admin\AppData\Local\Temp\01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe" "01c6dfb5925dbf107c4d60d931aa6640d460a9a2392349734875ff3ab8d57783.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5716