Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
16/10/2025, 02:46
General
- Target 2025-10-16_069a385a0de827a841693ba006395c03_darkgate_drokbk_elex_luca-stealer_njrat_rhadamanthys_smo.exe
- Size 3.6MB
- Sample251016-c9fbpatwdz
- SHA256 f69e621b6a1172ece99ebe6180ced480fa2a737a75cccfcede6650c23d4da1df
Malware Config
Extracted
-
njrat
-
<- NjRAT 0.7d Horror Edition ->
-
Victim
-
userbot.uswin.com.tr:6522
-
c855f704a4de3b3036455d37ea243043
-
reg_key
c855f704a4de3b3036455d37ea243043
-
splitter
Y262SUCZ4UJJ
Signatures
- Njrat family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-10-16_069a385a0de827a841693ba006395c03_darkgate_drokbk_elex_luca-stealer_njrat_rhadamanthys_smo.exe"C:\Users\Admin\AppData\Local\Temp\2025-10-16_069a385a0de827a841693ba006395c03_darkgate_drokbk_elex_luca-stealer_njrat_rhadamanthys_smo.exe"1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\evb6817.tmp"C:\Users\Admin\AppData\Local\Temp\zsl.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"{path}"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\FireFox Update Folder\FireFox Update.exe"C:\Users\Admin\AppData\Roaming\FireFox Update Folder\FireFox Update.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"{path}"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162
42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162
evb65DF.tmp
evb668C.tmp
evb67C7.tmp
evb6817.tmp
evb71DD.tmp
evb71EF.tmp
evb71F1.tmp
evb7203.tmp
FireFox Update.exe
memory/1676-1194-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3416-67-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-170-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-1217-0x0000000000400000-0x00000000004E0000-memory.dmp
memory/3416-26-0x00000000067A0000-0x000000000682C000-memory.dmp
memory/3416-1218-0x0000000010000000-0x0000000010134000-memory.dmp
memory/3416-62-0x0000000002D60000-0x0000000002DE8000-memory.dmp
memory/3416-56-0x0000000006900000-0x0000000006EA4000-memory.dmp
memory/3416-65-0x0000000002DF0000-0x0000000002E82000-memory.dmp
memory/3416-68-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-180-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-160-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-144-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-128-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-126-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-124-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-120-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-118-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-116-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-114-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-112-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-110-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-108-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-106-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-104-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-102-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-100-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-96-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-95-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-92-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-90-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-88-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-87-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-84-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-82-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-80-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-78-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-77-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-74-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-72-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-71-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-0-0x0000000000400000-0x00000000004E0000-memory.dmp
memory/3416-122-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-98-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-178-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-176-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-174-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-172-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-42-0x0000000006830000-0x00000000068E4000-memory.dmp
memory/3416-168-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-166-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-164-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-162-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-158-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-156-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-154-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-152-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-150-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-148-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-146-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-142-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-140-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-138-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-136-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-134-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-132-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-1139-0x0000000006830000-0x00000000068CC000-memory.dmp
memory/3416-1171-0x0000000006730000-0x000000000673E000-memory.dmp
memory/3416-45-0x0000000006830000-0x00000000068E4000-memory.dmp
memory/3416-1162-0x0000000006720000-0x0000000006730000-memory.dmp
memory/3416-1175-0x0000000002F30000-0x0000000002F3E000-memory.dmp
memory/3416-1174-0x0000000002F30000-0x0000000002F40000-memory.dmp
memory/3416-1179-0x00000000068E0000-0x00000000068EA000-memory.dmp
memory/3416-1173-0x0000000002F10000-0x0000000002F1A000-memory.dmp
memory/3416-1172-0x0000000002EE0000-0x0000000002EEA000-memory.dmp
memory/3416-46-0x0000000006830000-0x00000000068E4000-memory.dmp
memory/3416-1153-0x0000000002F20000-0x0000000002F2A000-memory.dmp
memory/3416-27-0x0000000006830000-0x00000000068E4000-memory.dmp
memory/3416-1146-0x0000000002EF0000-0x0000000002EFA000-memory.dmp
memory/3416-19-0x0000000002F40000-0x000000000304B000-memory.dmp
memory/3416-130-0x0000000002D60000-0x0000000002DE4000-memory.dmp
memory/3416-18-0x0000000002F40000-0x000000000304B000-memory.dmp
memory/3416-1195-0x00000000091C0000-0x000000000922C000-memory.dmp
memory/3416-1196-0x0000000000400000-0x00000000004E0000-memory.dmp
memory/3416-14-0x0000000002F40000-0x000000000304B000-memory.dmp
memory/3416-3-0x0000000077EA3000-0x0000000077EA4000-memory.dmp
memory/3416-10-0x0000000010000000-0x0000000010134000-memory.dmp
memory/3416-6-0x0000000010000000-0x0000000010134000-memory.dmp
memory/3416-2-0x0000000077EA2000-0x0000000077EA3000-memory.dmp
memory/3416-1205-0x0000000010000000-0x0000000010134000-memory.dmp
memory/3416-1206-0x0000000002F40000-0x000000000304B000-memory.dmp
memory/3416-1207-0x0000000006830000-0x00000000068E4000-memory.dmp
memory/3416-1220-0x0000000002EE0000-0x0000000002EEA000-memory.dmp
memory/3416-1219-0x0000000002F40000-0x000000000304B000-memory.dmp
memory/4920-64-0x00000000028C0000-0x0000000002973000-memory.dmp
memory/4920-49-0x0000000000100000-0x0000000000101000-memory.dmp