Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- user interaction
yes - max time kernel
133s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20251229-en - resource tags
- submitted
17/01/2026, 16:48
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260117-vbc3sagy6d
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
svcstealer
-
http://158.94.208.102/diamo/data.php
-
http://196.251.107.61/diamo/data.php
-
http://196.251.107.23/diamo/data.php
-
http://178.16.53.7/diamo/data.php
-
bot_urls
http://213.226.113.54/bin/bot.dll
-
build_id
16/11/2025
-
srv_delay
1
-
srv_retry
1
Extracted
-
njrat
-
0.7d
-
HacKed
-
hakim32.ddns.net:2000
-
exchange-reasonably.gl.at.ply.gg:30620
-
f41ac0c2ea25f3f8b0a75a7371d6b015
-
reg_key
f41ac0c2ea25f3f8b0a75a7371d6b015
-
splitter
|'|'|
Signatures
- Njrat family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Downloads MZ/PE file 3 IoCs
- Executes dropped EXE 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\NdisInstaller3.2.32.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\NdisInstaller3.2.32.1.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\Files\certinst.execertinst.exe root.cer3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\snetcfg.exesnetcfg.exe -v -l ndisrd_lwf.inf -c s -i nt_ndisrd3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I051Y5WAQK.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-I051Y5WAQK.tmp\Setup.tmp" /SL5="$B015A,2668797,842240,C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529514⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RG2VWDN45H.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-RG2VWDN45H.tmp\Setup.tmp" /SL5="$C015A,2668797,842240,C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529515⤵
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe"C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe" -Embedding6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LW.exe"C:\Users\Admin\AppData\Local\Temp\Files\LW.exe"2⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "048a9e88-f79b-402f-904f-55bec7f7a167c"3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "048a9e88-f79b-402f-904f-55bec7f7a167c" /tr "C:\ProgramData\aefbffbecfac.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Server1.exe"C:\Users\Admin\AppData\Local\Temp\Files\Server1.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b441afc7-ce34-494a-a697-5ea5c9eff669}\ndisrd_lwf.inf" "9" "4bd8d163f" "0000000000000140" "WinSta0\Default" "0000000000000160" "208" "C:\Users\Admin\AppData\Local\Temp\Files"2⤵
-
-
C:\ProgramData\aefbffbecfac.exeC:\ProgramData\aefbffbecfac.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ProtobufLite.dll
eServiceHost.exe
eServiceHost.exe
sciter-x.dll
vcruntime140.dll
LW.exe
NdisInstaller3.2.32.1.exe
Server1.exe
Setup.exe
certinst.exe
ndisrd.cat
ndisrd.sys
ndisrd_lwf.inf
root.cer
snetcfg.exe
Setup.tmp
_isdecmp.dll
memory/844-71-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/844-31-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/2092-59-0x00000000028D0000-0x00000000028FF000-memory.dmp
memory/2092-153-0x00000000028D0000-0x00000000028FF000-memory.dmp
memory/2092-154-0x00000000028D0000-0x00000000028FF000-memory.dmp
memory/2092-52-0x00000000028D0000-0x00000000028FF000-memory.dmp
memory/2092-144-0x00000000028D0000-0x00000000028FF000-memory.dmp
memory/2092-143-0x0000000002900000-0x0000000002901000-memory.dmp
memory/2092-145-0x00000000028D0000-0x00000000028FF000-memory.dmp
memory/2388-66-0x0000000000570000-0x00000000009A7000-memory.dmp
memory/3112-68-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/3112-191-0x00000000008D0000-0x00000000009AC000-memory.dmp
memory/3844-50-0x0000000140000000-0x000000014001D000-memory.dmp
memory/4736-0-0x0000000000EB0000-0x0000000000EB8000-memory.dmp
memory/4736-3-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/4736-2-0x0000000005B30000-0x0000000005B40000-memory.dmp
memory/4736-1-0x0000000005930000-0x00000000059CC000-memory.dmp