Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system - submitted
29/10/2025, 01:27
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
_b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
_b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe
Resource
win11-20251015-en
windows11-21h2-x64
5 signatures
150 seconds
General
- Target _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe
- Size 1.1MB
- Sample251029-bvk3ysslel
- SHA256 b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528
- MD5 978d5547a982ce9c09a9d3447603b9cb
- SHA1 a408c2d00a71d38f626a24e170a66c185895830e
- SHA512 677e4f17d4796fa2f89a4d25313b430937775d881f958cca6842e7ada1babde47296059ae2173bb387d3ec290961612ceb1017e038b993470098a4185cc682d2
- SSDEEP 24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaI1Ms4vrUX0o3fWiPT5:fh+ZkldoPK8YaIKs4jG0o3e6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
njrat
Version
-
0.7.3
Botnet
-
VILLATAXI
C2
-
villataxi.duckdns.org:1992
Mutex
-
Client.exe
Attributes
-
reg_key
Client.exe
-
splitter
1992
Signatures
- Njrat family
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4236 set thread context of 1420 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5268 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe Token: 33 1420 RegSvcs.exe Token: SeIncBasePriorityPrivilege 1420 RegSvcs.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4236 wrote to memory of 1420 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 89 PID 4236 wrote to memory of 1420 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 89 PID 4236 wrote to memory of 1420 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 89 PID 4236 wrote to memory of 1420 4236 _b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe 89 PID 1420 wrote to memory of 1056 1420 RegSvcs.exe 90 PID 1420 wrote to memory of 1056 1420 RegSvcs.exe 90 PID 1420 wrote to memory of 1056 1420 RegSvcs.exe 90 PID 1420 wrote to memory of 5268 1420 RegSvcs.exe 92 PID 1420 wrote to memory of 5268 1420 RegSvcs.exe 92 PID 1420 wrote to memory of 5268 1420 RegSvcs.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\_b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe"C:\Users\Admin\AppData\Local\Temp\_b5d5f6646fc657db12f60bd146588383b1bb2f302772471cb35ecf87edf4d528.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:1056
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5268
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe1⤵
- System Location Discovery: System Language Discovery
PID:220
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe1⤵
- System Location Discovery: System Language Discovery
PID:1864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe1⤵
- System Location Discovery: System Language Discovery
PID:1596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe1⤵
- System Location Discovery: System Language Discovery
PID:64
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
- Size 142B
- SHA256 c578e86db701b9afa3626e804cf434f9d32272ff59fb32fa9a51835e5a148b53
- MD5 8c0458bb9ea02d50565175e38d577e35
- SHA1 f0b50702cd6470f3c17d637908f83212fdbdb2f2
- SHA512 804a47494d9a462ffa6f39759480700ecbe5a7f3a15ec3a6330176ed9c04695d2684bf6bf85ab86286d52e7b727436d0bb2e8da96e20d47740b5ce3f856b5d0f
- MD5 SHA1 SHA512