njrat | c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861.exe
Size 43KB
Sample260718-gqlftads6x
SHA256 c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861
MD5 1e7f18f1e50a222a17888d3de9e63730
SHA1 1159f0e2879c2d70dadc31bcc3356d62c69cb264
SHA512 a728ccf3e6a1c4a2a9ac0545bf1e6ffd595d5208fa2e43ae66917aa0a1c01148a1bf356ca05aeb2142ee3fec53e8de6747bbf99af8834497d573b04c0e1d7035
SSDEEP 384:kZylX7xdW/IUyNZa55EFiTYM0EvbV56lpzYIij+ZsNO3PlpJKkkjh/TzF7pWn+/l:SorxIghNZk5EFiTVTbCpuXQ/o33+L
TLSH
T10513D78DB694E174D5FF8BF1B4A2B2890B71A017A902D30F99F114D94BB3AC09611EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacked discovery execution njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

62.60.226.185:6000

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe	Dllhost.exe

Executes dropped EXE 6 IoCs

pid	Process
2064	Dllhost.exe
3724	Dllhost.exe
4660	Server.exe
3768	Server.exe
3400	Server.exe
1064	Server.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .."	Dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Dllhost.exe\" .."	Dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dllhost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4384	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4816	c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861.exe
2064	Dllhost.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe
Token: 33	2064	Dllhost.exe
Token: SeIncBasePriorityPrivilege	2064	Dllhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 2064	4816	c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861.exe	89
PID 2064 wrote to memory of 4384	2064	Dllhost.exe	90

C:\Users\Admin\AppData\Local\Temp\c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861.exe
"C:\Users\Admin\AppData\Local\Temp\c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
  "C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4384

C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe" ..
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3724

C:\Users\Admin\AppData\Local\Temp\Server.exe
C:\Users\Admin\AppData\Local\Temp/Server.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp/Server.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dllhost.exe

Path C:\Users\Admin\AppData\Local\Temp\Dllhost.exe
Size 43KB
SHA256 c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861
MD5 1e7f18f1e50a222a17888d3de9e63730
SHA1 1159f0e2879c2d70dadc31bcc3356d62c69cb264
SHA512 a728ccf3e6a1c4a2a9ac0545bf1e6ffd595d5208fa2e43ae66917aa0a1c01148a1bf356ca05aeb2142ee3fec53e8de6747bbf99af8834497d573b04c0e1d7035
SSDEEP 384:kZylX7xdW/IUyNZa55EFiTYM0EvbV56lpzYIij+ZsNO3PlpJKkkjh/TzF7pWn+/l:SorxIghNZk5EFiTVTbCpuXQ/o33+L
TLSH
T10513D78DB694E174D5FF8BF1B4A2B2890B71A017A902D30F99F114D94BB3AC09611EE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2064-24-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/2064-15-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/2064-28-0x0000000005650000-0x000000000565A000-memory.dmp

Download

memory/2064-25-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/2064-16-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3724-23-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3724-21-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/3724-26-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/4816-2-0x0000000004DA0000-0x0000000004E3C000-memory.dmp

Download

memory/4816-17-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

memory/4816-1-0x0000000000290000-0x00000000002A2000-memory.dmp

Download

memory/4816-5-0x0000000005200000-0x0000000005292000-memory.dmp

Download

memory/4816-0-0x00000000749B2000-0x00000000749B3000-memory.dmp

Download

memory/4816-4-0x0000000005720000-0x0000000005CDA000-memory.dmp

Download

memory/4816-3-0x00000000749A0000-0x000000007515C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads