Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/08/2026, 03:16
General
- Target dwas.exe
- Size 55KB
- Sample260827-dsty7aygra
- SHA256 558a3ed993d2871420683e786d27d4e17ee4ed817307a2a92fd0137c1c4558f9
Malware Config
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- UAC bypass 3 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry key 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dwas.exe"C:\Users\Admin\AppData\Local\Temp\dwas.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\8994b3356da04964ba3dbfa4a42bdcca.exe"C:\Users\Admin\AppData\Local\Temp\8994b3356da04964ba3dbfa4a42bdcca.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x2d01⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
8994b3356da04964ba3dbfa4a42bdcca.exe
memory/1540-0-0x00000000010D0000-0x00000000010E0000-memory.dmp
memory/1540-1-0x0000000074FE2000-0x0000000074FE4000-memory.dmp
memory/1540-2-0x00000000010D0000-0x00000000010E0000-memory.dmp
memory/1540-3-0x0000000074FE2000-0x0000000074FE4000-memory.dmp
memory/1540-4-0x0000000074FE0000-0x0000000075591000-memory.dmp
memory/1540-5-0x0000000074FE0000-0x0000000075591000-memory.dmp
memory/1916-20-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-26-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-18-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-21-0x000000001B600000-0x000000001BACE000-memory.dmp
memory/1916-22-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-17-0x00007FFDC68E5000-0x00007FFDC68E6000-memory.dmp
memory/1916-23-0x000000001BC30000-0x000000001BCCC000-memory.dmp
memory/1916-24-0x00000000009E0000-0x00000000009E8000-memory.dmp
memory/1916-25-0x000000001BD90000-0x000000001BDDC000-memory.dmp
memory/1916-19-0x000000001B080000-0x000000001B126000-memory.dmp
memory/1916-27-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-28-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-29-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-30-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-31-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-32-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-33-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp
memory/1916-35-0x00007FFDC6630000-0x00007FFDC6FD1000-memory.dmp