Analysis
- user interaction
yes - max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 14:25
General
- Target Payload.exe
- Size 59KB
- Sample260820-rrls3sstbv
- SHA256 1f4bc87d1ab59d68b9789e497ab88a750bd0946e68ff7039836db4cd9e5ba38e
Malware Config
Extracted
-
njrat
-
<- NjRAT 0.7d Horror Edition ->
-
HELLO
-
john12dqr23-37470.portmap.host:6060
-
0b10454cc801fdef844db29c3dc69421
-
reg_key
0b10454cc801fdef844db29c3dc69421
-
splitter
Y262SUCZ4UJJ
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2704-0-0x0000000074852000-0x0000000074853000-memory.dmp
memory/2704-1-0x00000000006F0000-0x0000000000706000-memory.dmp
memory/2704-2-0x00000000052D0000-0x000000000536C000-memory.dmp
memory/2704-3-0x0000000005930000-0x0000000005EEA000-memory.dmp
memory/2704-4-0x0000000005420000-0x00000000054B2000-memory.dmp
memory/2704-5-0x0000000074840000-0x0000000074FFC000-memory.dmp
memory/2704-6-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/2704-7-0x0000000074852000-0x0000000074853000-memory.dmp
memory/2704-8-0x0000000074840000-0x0000000074FFC000-memory.dmp