Overview

overview

10

Static

static

3

omesfn.exe

windows10-ltsc_2021-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    24s
  • max time network
    26s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    14/08/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    omesfn.exe
  • Size 16.8MB
  • Sample260814-eck7safa53
  • SHA256 91b740341c9261688ca666bf5677b521cf4c6a1c1d3b29a185f3019f42ce7bc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • hakim32.ddns.net:2000

  • fds6gbae3v.localto.net:4294

Mutex

  • b9c3a6c98ae0f4ff9d14378e06801af9

Attributes
  • reg_key

    b9c3a6c98ae0f4ff9d14378e06801af9

  • splitter

    |'|'|

Signatures

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\omesfn.exe
    "C:\Users\Admin\AppData\Local\Temp\omesfn.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:556
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAaABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGwAbQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAbQBiACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGEAbQBrACMAPgA="
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:928
    • C:\Users\Admin\AppData\Roaming\omesfn.exe
      "C:\Users\Admin\AppData\Roaming\omesfn.exe"
      2⤵
      • Executes dropped EXE
      PID:3060
    • C:\Users\Admin\AppData\Roaming\omesf.exe
      "C:\Users\Admin\AppData\Roaming\omesf.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Windows\server.exe
        "C:\Windows\server.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:832
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall delete allowedprogram "C:\Windows\server.exe"
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2172
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\server.exe" "server.exe" ENABLE
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        __PSScriptPolicyTest_0mmjpaw1.c3r.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0mmjpaw1.c3r.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app
        • Path C:\Users\Admin\AppData\Roaming\app
        • Size 5B
        • SHA256 f7c301f3fcce1c2444b540090e5024f0cea1806ab8ae1d81901ecc3b63334cbb
        • MD5 SHA1 SHA512
        Submit Download

        omesf.exe
        • Path C:\Users\Admin\AppData\Roaming\omesf.exe
        • Size 93KB
        • SHA256 41c8ff8dc26cd55fff37409774b7e5fb7a415d454747dcf6468a6a8166d61363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        omesfn.exe
        • Path C:\Users\Admin\AppData\Roaming\omesfn.exe
        • Size 16.7MB
        • SHA256 b3fb2e0ccd24cda6628e78f7976d08acd97678be3048efae8f391ef282bb2718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/556-0-0x0000000000B30000-0x0000000001C00000-memory.dmp
        Download

        memory/556-1-0x000000001C700000-0x000000001C710000-memory.dmp
        Download

        memory/928-8-0x000001407F540000-0x000001407F550000-memory.dmp
        Download

        memory/928-9-0x000001407F540000-0x000001407F550000-memory.dmp
        Download

        memory/928-27-0x0000014066E00000-0x0000014066E22000-memory.dmp
        Download