Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
16/10/2025, 02:46
General
- Target 2025-10-16_069a385a0de827a841693ba006395c03_darkgate_drokbk_elex_luca-stealer_njrat_rhadamanthys_smo.exe
- Size 3.6MB
- Sample251016-c9fbpatwdz
- SHA256 f69e621b6a1172ece99ebe6180ced480fa2a737a75cccfcede6650c23d4da1df
Malware Config
Extracted
-
njrat
-
<- NjRAT 0.7d Horror Edition ->
-
Victim
-
userbot.uswin.com.tr:6522
-
c855f704a4de3b3036455d37ea243043
-
reg_key
c855f704a4de3b3036455d37ea243043
-
splitter
Y262SUCZ4UJJ
Signatures
- Njrat family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-10-16_069a385a0de827a841693ba006395c03_darkgate_drokbk_elex_luca-stealer_njrat_rhadamanthys_smo.exe"C:\Users\Admin\AppData\Local\Temp\2025-10-16_069a385a0de827a841693ba006395c03_darkgate_drokbk_elex_luca-stealer_njrat_rhadamanthys_smo.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\evb5B17.tmp"C:\Users\Admin\AppData\Local\Temp\zsl.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"{path}"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\FireFox Update Folder\FireFox Update.exe"C:\Users\Admin\AppData\Roaming\FireFox Update Folder\FireFox Update.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"{path}"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162
42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5
66AE3BFDF94A732B262342AD2154B86E_108A7991F73F2B507007C35661993162
evb5871.tmp
evb592E.tmp
evb5A87.tmp
evb5B17.tmp
evb64DC.tmp
evb64EF.tmp
evb6510.tmp
evb6511.tmp
FireFox Update.exe
memory/1284-157-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-10-0x0000000010000000-0x0000000010134000-memory.dmp
memory/1284-46-0x0000000006000000-0x00000000060B4000-memory.dmp
memory/1284-28-0x00000000069A0000-0x0000000006A54000-memory.dmp
memory/1284-37-0x00000000069A0000-0x0000000006A54000-memory.dmp
memory/1284-48-0x00000000069A0000-0x0000000006F46000-memory.dmp
memory/1284-49-0x0000000006050000-0x00000000060D8000-memory.dmp
memory/1284-55-0x0000000006F50000-0x0000000006FE2000-memory.dmp
memory/1284-75-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-73-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-1223-0x0000000010000000-0x0000000010134000-memory.dmp
memory/1284-1222-0x0000000003000000-0x000000000310B000-memory.dmp
memory/1284-181-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-179-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-177-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-175-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-171-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-98-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-167-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-163-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-161-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-159-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-155-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-1221-0x0000000000400000-0x00000000004E0000-memory.dmp
memory/1284-1211-0x0000000002E60000-0x0000000002E6A000-memory.dmp
memory/1284-153-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-151-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-149-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-147-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-145-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-143-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-141-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-137-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-135-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-133-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-131-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-129-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-127-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-125-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-123-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-121-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-173-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-165-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-43-0x00000000069A0000-0x0000000006A54000-memory.dmp
memory/1284-139-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-111-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-109-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-107-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-47-0x0000000006000000-0x00000000060B4000-memory.dmp
memory/1284-105-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-169-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-93-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-91-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-89-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-87-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-85-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-83-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-79-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-77-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-71-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-67-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-66-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-61-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-59-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-57-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-56-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-103-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-81-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-69-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-63-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-23-0x0000000006910000-0x000000000699C000-memory.dmp
memory/1284-1169-0x0000000002E60000-0x0000000002E6A000-memory.dmp
memory/1284-1174-0x0000000000400000-0x00000000004E0000-memory.dmp
memory/1284-1183-0x0000000002EC0000-0x0000000002ED0000-memory.dmp
memory/1284-18-0x0000000003000000-0x000000000310B000-memory.dmp
memory/1284-1193-0x0000000002ED0000-0x0000000002EDE000-memory.dmp
memory/1284-1196-0x0000000002EB0000-0x0000000002EBE000-memory.dmp
memory/1284-1195-0x0000000003000000-0x000000000310B000-memory.dmp
memory/1284-1194-0x0000000010000000-0x0000000010134000-memory.dmp
memory/1284-22-0x0000000003000000-0x000000000310B000-memory.dmp
memory/1284-1185-0x0000000002EB0000-0x0000000002EC0000-memory.dmp
memory/1284-14-0x0000000003000000-0x000000000310B000-memory.dmp
memory/1284-1171-0x0000000002E90000-0x0000000002E9A000-memory.dmp
memory/1284-1165-0x0000000002E70000-0x0000000002E7A000-memory.dmp
memory/1284-101-0x0000000006050000-0x00000000060D4000-memory.dmp
memory/1284-1199-0x0000000002F50000-0x0000000002F5A000-memory.dmp
memory/1284-6-0x0000000010000000-0x0000000010134000-memory.dmp
memory/1284-3-0x0000000077C35000-0x0000000077C36000-memory.dmp
memory/1284-2-0x0000000077C34000-0x0000000077C35000-memory.dmp
memory/1284-0-0x0000000000400000-0x00000000004E0000-memory.dmp
memory/1284-1206-0x00000000092F0000-0x000000000935C000-memory.dmp
memory/1284-1207-0x00000000069A0000-0x0000000006A54000-memory.dmp
memory/1284-1208-0x00000000069A0000-0x0000000006A54000-memory.dmp
memory/1284-1209-0x0000000006000000-0x00000000060B4000-memory.dmp
memory/1284-1210-0x0000000006000000-0x00000000060B4000-memory.dmp
memory/2576-119-0x00000000029C0000-0x0000000002A73000-memory.dmp
memory/2576-52-0x0000000000100000-0x0000000000101000-memory.dmp
memory/3976-376-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3976-377-0x0000000005840000-0x00000000058DC000-memory.dmp