njrat | 4551f776a0069b087192a3d07bca8b171eeef6999fbda54b05592b6df0243e2f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Usb Evil Injector.exe
Size 1.1MB
Sample260803-bc51eaaj7t
SHA256 4551f776a0069b087192a3d07bca8b171eeef6999fbda54b05592b6df0243e2f
MD5 6ea7b17da22670191dfd39f0afc3d0d2
SHA1 a7972461c6aa29e4e14fa5b53b3f4bffe1f09a55
SHA512 bd52a29f7bbcb76e7b91967595ce5c254460daee0f6ced79f858ceabb854fa56d0a27f78ce1d3fa145e4878bd6dd401143aebfd70ec9872354d8b35a72723b5a
SSDEEP 24576:d/65CByZZ3RyKwK/sab2cTBnEm2eHgFzMhMo0zywOkQa0+io:dSnZZ2K/ThT+m2eCEMo0Wdd+io
TLSH
T1F7352310B181C077C1110B7D5E07E668A93F9A142A7E1297B7DD0F0EAEDA3861D6D2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

logiin defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Logiin

ffy643dfxvtesdyekyg.ddns.net:6060

Mutex

b02cdad74057151abb2f867067ec6571

Attributes

reg_key
b02cdad74057151abb2f867067ec6571
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1948	netsh.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b02cdad74057151abb2f867067ec6571.exe	Tomvpns.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b02cdad74057151abb2f867067ec6571.exe	Tomvpns.exe

Executes dropped EXE 4 IoCs

pid	Process
5764	UsbEvil.exe
6068	Tomvpns.exe
1864	Usb Evil Injector.exe
5684	Tomvpns.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\b02cdad74057151abb2f867067ec6571 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Tomvpns.exe\" .."	Tomvpns.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b02cdad74057151abb2f867067ec6571 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Tomvpns.exe\" .."	Tomvpns.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Usb Evil Injector.exe	Usb Evil Injector.exe
File opened for modification	C:\Windows\SysWOW64\UsbEvil.exe	Usb Evil Injector.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\CloudEng\Usb Evil Injector\Uninstall.exe	Usb Evil Injector.exe
File created	C:\Program Files (x86)\CloudEng\Usb Evil Injector\Uninstall.ini	Usb Evil Injector.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UsbEvil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tomvpns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tomvpns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Usb Evil Injector.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe
Token: 33	6068	Tomvpns.exe
Token: SeIncBasePriorityPrivilege	6068	Tomvpns.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 5764	2420	Usb Evil Injector.exe	89
PID 5764 wrote to memory of 6068	5764	UsbEvil.exe	92
PID 6068 wrote to memory of 1948	6068	Tomvpns.exe	94
PID 2420 wrote to memory of 1864	2420	Usb Evil Injector.exe	96

C:\Users\Admin\AppData\Local\Temp\Usb Evil Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Usb Evil Injector.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\UsbEvil.exe
  "C:\Windows\system32\UsbEvil.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Tomvpns.exe
    "C:\Users\Admin\AppData\Local\Temp\Tomvpns.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6068
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Tomvpns.exe" "Tomvpns.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1948
- C:\Windows\SysWOW64\Usb Evil Injector.exe
  "C:\Windows\system32\Usb Evil Injector.exe"
  2⤵
  - Executes dropped EXE
  PID:1864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2676

C:\Users\Admin\AppData\Local\Temp\Tomvpns.exe
"C:\Users\Admin\AppData\Local\Temp\Tomvpns.exe" ..
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Usb Evil Injector.exe

Path C:\Windows\SysWOW64\Usb Evil Injector.exe
Size 1.2MB
SHA256 5cd8af351808ed8f03906ccb0573f6f187dcdf65468f29cdb53533c523ca837c
MD5 8c6a2858649cd608a5dd0b8177811ea6
SHA1 a6bec5948f6bcbb1aa4f7a86622224b13d224bbe
SHA512 4ff56e6d938680549c06c4d5ee9e6e190ae5f95d7d18fa4b7f31051c3274d85f55e5e8d8c002a939949b46e275a07f25c6f5be63b8ca1d32be8cb71d98469e90
SSDEEP 24576:KvLZ8R3KwSws5b2CTBFam2e8gfBLhpg4zczZN8Sy:YLZaSw8nTGm2elfpg4IzL8/
TLSH
T13E45F00D62938465E53E1B348563DD7C5376BF521AA3CAEA0AD43D1B3F723818D21BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsbEvil.exe

Path C:\Windows\SysWOW64\UsbEvil.exe
Size 23KB
SHA256 8973727793686d03e836de462993a97020f01e2d213d60b2b01de75bc2bd83d0
MD5 a1ea927974b2dd367eafea235461d9fa
SHA1 746c262c581ea73f930db94b92e47d9223c5d21f
SHA512 edd3e9545c8256689973701d0b54850a4693cd31344111b05b0a8302fb23fcd0cf3e40763f22e6b764d8b23ab054e8adec2e8a1d10816d98e4ad6802adc502cb
SSDEEP 384:fvMKFYuEEhERvoBG16Xuy0MHNw6Tg1Y+75JTFmRvR6JZlbw8hqIusZzZaj:fEW4V6+yDRpcnu7
TLSH
T1A9B21A0E3FA98856C5BC1B7486A5965003B491870413EE2FCDC554CBAFB3BD91D8CAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1864-66-0x0000000000F60000-0x0000000001098000-memory.dmp

Download

memory/2420-48-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2420-19-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2420-60-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2420-20-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2420-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5764-46-0x00000000015F0000-0x0000000001600000-memory.dmp

Download

memory/5764-47-0x00000000727B2000-0x00000000727B4000-memory.dmp

Download

memory/6068-58-0x00000000727B0000-0x0000000072DD1000-memory.dmp

Download

memory/6068-59-0x00000000727B0000-0x0000000072DD1000-memory.dmp

Download

memory/6068-69-0x00000000727B0000-0x0000000072DD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads