njrat | 8df0f753f89e7f981a8d37302fdf48f29d030d35944489c9cdd01e15a79159b7

General

Target
2026-08-06_1d30b563b0c154b4734637e7dc4cb782_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 536KB
Sample260806-dplhmscp6x
SHA256 8df0f753f89e7f981a8d37302fdf48f29d030d35944489c9cdd01e15a79159b7
MD5 1d30b563b0c154b4734637e7dc4cb782
SHA1 9be7a85fdaffdb150d2ad8cb6f44c426f856b2ed
SHA512 cc7084967b11af28f863483fa187bcdc459872474edb9029369618eea1672f5af06ca96e94b171834b4d5eaf28f410b605c22eb008c1284e27b3eb6d34922ceb
SSDEEP 12288:6miMZvN43+u85Bpw+YMRkc95rpXOBhgql:TnvS+55BpfRX95rpXOBhTl
TLSH
T194C48D19D7F405F9E0B7E578CD834912E7767C494771E68F03A4A9A61F232908E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim discovery njrat trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

127.0.0.1:6522

Mutex

0b1bb5131ed4fe61714ed0121c89735a

Attributes

reg_key
0b1bb5131ed4fe61714ed0121c89735a
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/files/0x0005000000016b3f-6.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/memory/4424-16-0x00000000006D0000-0x0000000000710000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Executes dropped EXE 2 IoCs

pid	Process
4424	Windows 10 Greeang.exe
112	dllhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Windows 10 Greeang.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-06_1d30b563b0c154b4734637e7dc4cb782_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	mspaint.exe
1900	mspaint.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe
Token: 33	112	dllhost.exe
Token: SeIncBasePriorityPrivilege	112	dllhost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1900	mspaint.exe
1900	mspaint.exe
1900	mspaint.exe
1900	mspaint.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 4424	3724	2026-08-06_1d30b563b0c154b4734637e7dc4cb782_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	90
PID 3724 wrote to memory of 1900	3724	2026-08-06_1d30b563b0c154b4734637e7dc4cb782_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	91
PID 4424 wrote to memory of 112	4424	Windows 10 Greeang.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-06_1d30b563b0c154b4734637e7dc4cb782_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_1d30b563b0c154b4734637e7dc4cb782_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Users\Admin\AppData\Local\Temp\Windows 10 Greeang.exe
  "C:\Users\Admin\AppData\Local\Temp\Windows 10 Greeang.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Users\Admin\AppData\Roaming\dllhost.exe
    "C:\Users\Admin\AppData\Roaming\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:112
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Icon.png"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Icon.png

Path C:\Users\Admin\AppData\Local\Temp\Icon.png
Size 39KB
SHA256 2d9f9a4355985cd155e222ec187e1ba5c86000e491157fbdb4f8e5891b62a358
MD5 e2b04ce33dd86b87cd69b8f243289b7b
SHA1 2a1c25770aa4802216f029d0f2578458e31014eb
SHA512 c782ce8286af0068133ce07751e3453be8baaf4bdd0dcfe5e23e248bd564842256ed45d4cf22dc7038cf88e3ad49d2defdb13358d8632166bde4ba7a2c10f625
SSDEEP 768:ym/8yGDAT3TCPJknN+8vo7EFLlOlB39yoGmZ6Z5I4t8ygn5J2vnVM:U2eJkU89lOxJGFHFts54VM
TLSH
T18303F16D3230E5A4D971E7B93D8E9BA8AA093DCB7C231D0FC29E3C715A9C53311825D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows 10 Greeang.exe

Path C:\Users\Admin\AppData\Local\Temp\Windows 10 Greeang.exe
Size 231KB
SHA256 eacc710a8e8859a405af7825bf1317e19949fdf79d76e1e5be354d0ceda48cfc
MD5 d62e2f00fcc20896dd490b05d27f2a5a
SHA1 ca14e59b0da397fc56371552e9a8abe6feeae454
SHA512 1769c2c08edc194c683a6b63c0832a44e7612fffb0356602293c696ceac93ecc28cde517e46a7a19cb8216c09ba212b7e8ee7e95874cc9f19ebfc1b68a6fd0db
SSDEEP 1536:kmTdk7RTKk7hITqfiXiHJyBa+2v0+OeSXaxI3pmwr:NSZITkqiHJ6ab0b5XaxI3pm
TLSH
T15F34F8C9B79BB444E0EC063298E1E07DC6737C7678D1921AB6F7B65F26323824D08E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-29-0x0000000005350000-0x00000000053E2000-memory.dmp

Download

memory/112-30-0x00000000052F0000-0x00000000052FA000-memory.dmp

Download

memory/4424-15-0x0000000074BD2000-0x0000000074BD3000-memory.dmp

Download

memory/4424-16-0x00000000006D0000-0x0000000000710000-memory.dmp

Download

memory/4424-17-0x0000000005130000-0x00000000051CC000-memory.dmp

Download

memory/4424-18-0x0000000005790000-0x0000000005D4A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads