Analysis
- max time kernel
149s - max time network
130s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
18/05/2026, 22:47
General
- Target Server.exe
- Size 43KB
- Sample260518-2qlrsshw7n
- SHA256 5938d50c3815ea292131fd9c15775e28fc3b1d353a1a7774e1b67e3a339ce425
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
HacKed
C2
-
ncat iraqrklwt-30656.portmap.host:1337
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server.exe"C:\Users\Admin\AppData\Local\Temp\Server.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5328-0-0x00000000001D0000-0x00000000001E2000-memory.dmp
memory/5328-1-0x0000000004C40000-0x0000000004CDC000-memory.dmp
memory/5328-2-0x0000000004F60000-0x0000000004F70000-memory.dmp
memory/5328-3-0x0000000005620000-0x0000000005BC6000-memory.dmp
memory/5328-4-0x0000000005110000-0x00000000051A2000-memory.dmp
memory/5328-5-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/5328-6-0x0000000004F60000-0x0000000004F70000-memory.dmp