Analysis

  • user interaction
    yes
  • max time kernel
    32s
  • max time network
    25s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 17:58

General

  • Target
    protected_test.exe
  • Size 432KB
  • Sample260822-wknrbasvaz
  • SHA256 5c0bbb9574e3ce9f7bf05b4107c12fcf318e6808588521e41865cec32f8e055e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • njrat

Version
  • im523

Botnet
  • SOFT

C2
  • 45.84.227.157:5012

Mutex
  • 0ec846a435bf91138081ad39491b85bb

Attributes
  • reg_key

    0ec846a435bf91138081ad39491b85bb

  • splitter

    |'|'|

Signatures

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

Processes

  • C:\Users\Admin\AppData\Local\Temp\protected_test.exe
    "C:\Users\Admin\AppData\Local\Temp\protected_test.exe"
    1⤵
      PID:4512

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/4512-0-0x0000000000DD0000-0x0000000000E43000-memory.dmp

          memory/4512-2-0x0000000004E4C000-0x0000000004E4D000-memory.dmp

          memory/4512-3-0x0000000005360000-0x0000000005370000-memory.dmp

          memory/4512-4-0x00000000046B0000-0x0000000005054000-memory.dmp

          memory/4512-5-0x00000000046B0000-0x0000000005054000-memory.dmp

          memory/4512-9-0x0000000005360000-0x000000000536A000-memory.dmp

          memory/4512-7-0x0000000005360000-0x000000000536A000-memory.dmp

          memory/4512-6-0x0000000005360000-0x000000000536A000-memory.dmp

          memory/4512-12-0x00000000046B0000-0x0000000005054000-memory.dmp

          memory/4512-13-0x00000000046B0000-0x0000000005054000-memory.dmp

          memory/4512-23-0x0000000001EC0000-0x0000000001F67000-memory.dmp

          memory/4512-16-0x0000000001440000-0x00000000017E1000-memory.dmp

          memory/4512-38-0x00000000045B0000-0x000000000464B000-memory.dmp

          memory/4512-31-0x0000000003E40000-0x00000000041BC000-memory.dmp

          memory/4512-27-0x0000000002270000-0x00000000023BB000-memory.dmp

          memory/4512-25-0x0000000002090000-0x00000000021B1000-memory.dmp

          memory/4512-24-0x0000000001F70000-0x0000000002086000-memory.dmp

          memory/4512-22-0x0000000001E10000-0x0000000001EB9000-memory.dmp

          memory/4512-19-0x0000000001BF0000-0x0000000001CA2000-memory.dmp

          memory/4512-18-0x00000000019C0000-0x0000000001B83000-memory.dmp

          memory/4512-17-0x0000000001920000-0x00000000019BD000-memory.dmp

          memory/4512-44-0x000000001F410000-0x000000001F46F000-memory.dmp

          memory/4512-43-0x0000000005100000-0x00000000051CD000-memory.dmp

          memory/4512-42-0x00000000050E0000-0x00000000050FB000-memory.dmp

          memory/4512-41-0x00000000050D0000-0x00000000050DC000-memory.dmp

          memory/4512-36-0x0000000004460000-0x00000000044F9000-memory.dmp

          memory/4512-35-0x0000000004440000-0x000000000445A000-memory.dmp

          memory/4512-34-0x00000000042A0000-0x0000000004439000-memory.dmp

          memory/4512-33-0x00000000041C0000-0x0000000004296000-memory.dmp

          memory/4512-28-0x00000000025D0000-0x00000000025FF000-memory.dmp

          memory/4512-26-0x00000000021C0000-0x0000000002263000-memory.dmp

          memory/4512-21-0x0000000001DB0000-0x0000000001DDA000-memory.dmp

          memory/4512-20-0x0000000001B90000-0x0000000001BB7000-memory.dmp

          memory/4512-14-0x00007FFB96540000-0x00007FFB967A3000-memory.dmp

          memory/4512-40-0x0000000005070000-0x00000000050CD000-memory.dmp

          memory/4512-15-0x0000000001370000-0x0000000001437000-memory.dmp

          memory/4512-37-0x0000000004500000-0x000000000456D000-memory.dmp

          memory/4512-32-0x0000000003D60000-0x0000000003D7D000-memory.dmp

          memory/4512-30-0x0000000003D90000-0x0000000003E3D000-memory.dmp

          memory/4512-29-0x0000000003BF0000-0x0000000003C38000-memory.dmp