njrat | f7d62fe998dd96090baba7c331f9346c9c13052c0a2df37cc88b65625b2a5a63

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
minecraftclient.exe
Size 157KB
Sample260718-2d3vjset5j
SHA256 f7d62fe998dd96090baba7c331f9346c9c13052c0a2df37cc88b65625b2a5a63
MD5 2bf5cda687b76dac239b244495982c3a
SHA1 0a8bc542bfb2c7741d140a4006d5b62c6144c696
SHA512 fdc780933b090fcb9914a859b54adca59375e1e72e35dbccf4e05ef40c3e8466d7564d458833bd8568c89c327588b58193b24d620534eb9bcdffea7d0fc6b8ab
SSDEEP 3072:fNqH1S4kdEAQmhrfmDTFgHWIc8rW7vrhR1qLA1GDZa7yU1:fWtAQs+PWWIlruBqLmiZa
TLSH
T148F3EA6B75848F15DE542C75C4EBA53013E2ADC71B33F28A3F4826A92E413E35D8A7C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5372	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0427d88674ad43d90b98aebf9ed0a565.exe	minecraftclient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0427d88674ad43d90b98aebf9ed0a565.exe	minecraftclient.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\0427d88674ad43d90b98aebf9ed0a565 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\minecraftclient.exe\" .."	minecraftclient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0427d88674ad43d90b98aebf9ed0a565 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\minecraftclient.exe\" .."	minecraftclient.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	minecraftclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	minecraftclient.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe
Token: 33	1972	minecraftclient.exe
Token: SeIncBasePriorityPrivilege	1972	minecraftclient.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 5372	1972	minecraftclient.exe	89

C:\Users\Admin\AppData\Local\Temp\minecraftclient.exe
"C:\Users\Admin\AppData\Local\Temp\minecraftclient.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\minecraftclient.exe" "minecraftclient.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5372

C:\Users\Admin\AppData\Local\Temp\minecraftclient.exe
"C:\Users\Admin\AppData\Local\Temp\minecraftclient.exe" ..
1⤵
- System Location Discovery: System Language Discovery
PID:3748