njrat | 6b64d09982b44fe9e1e6bdb0c321df8b36932f146de189db5eaf56b5de81d265

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Backseat.exe
Size 12.0MB
Sample260923-tptr1ss1b1
SHA256 6b64d09982b44fe9e1e6bdb0c321df8b36932f146de189db5eaf56b5de81d265
MD5 db7d4995492f5d47ea179ed375fdd7bc
SHA1 e8f19372ac09ceee66ca43cccc76090a2c792ef6
SHA512 b3307a18308a3d14a2ac3ef4572e07834480b6b20236cf61012929a6cf00572178348121c42624e130fed0b1b404ee8249f997ac59cc4f1f70669ed1f54aa86d
SSDEEP 768:SY3ZznD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3ysGy:XzxOx6baIa9RZj00ljEwzGi1dDuDkgS
TLSH
T198C6E84977E52524E4BF56F79871F2004E34B48B1602E39D48F259AA1B33AC44F89FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bk defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hakim32.ddns.net:2000
zenvyus.ddns.net:8080

Mutex

998188c985c958637c472cc328ab665f

Attributes

reg_key
998188c985c958637c472cc328ab665f
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1980	netsh.exe

Creates a file in the Startup directory 1 TTPs 6 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\998188c985c958637c472cc328ab665fWindows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\998188c985c958637c472cc328ab665fWindows Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	server.exe

Executes dropped EXE 2 IoCs

pid	Process
4840	server.exe
4940	tmp4A15.tmp.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Explower.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\Explower.exe	server.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Explower.exe	server.exe
File created	C:\Program Files (x86)\Explower.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp4A15.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Backseat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4852	WINWORD.EXE
4852	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe
4840	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4840	server.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: SeDebugPrivilege	4940	tmp4A15.tmp.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe
Token: 33	4840	server.exe
Token: SeIncBasePriorityPrivilege	4840	server.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4852	WINWORD.EXE
4852	WINWORD.EXE
4852	WINWORD.EXE
4852	WINWORD.EXE
4852	WINWORD.EXE
4852	WINWORD.EXE
4852	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4840	720	Backseat.exe	89
PID 4840 wrote to memory of 1980	4840	server.exe	90
PID 4840 wrote to memory of 4940	4840	server.exe	96

C:\Users\Admin\AppData\Local\Temp\Backseat.exe
"C:\Users\Admin\AppData\Local\Temp\Backseat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1980
- - C:\Users\Admin\AppData\Local\Temp\tmp4A15.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp4A15.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4940

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\SaveExpand.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

server.exe

Path C:\Users\Admin\AppData\Local\Temp\server.exe
Size 12.0MB
SHA256 6b64d09982b44fe9e1e6bdb0c321df8b36932f146de189db5eaf56b5de81d265
MD5 db7d4995492f5d47ea179ed375fdd7bc
SHA1 e8f19372ac09ceee66ca43cccc76090a2c792ef6
SHA512 b3307a18308a3d14a2ac3ef4572e07834480b6b20236cf61012929a6cf00572178348121c42624e130fed0b1b404ee8249f997ac59cc4f1f70669ed1f54aa86d
SSDEEP 768:SY3ZznD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3ysGy:XzxOx6baIa9RZj00ljEwzGi1dDuDkgS
TLSH
T198C6E84977E52524E4BF56F79871F2004E34B48B1602E39D48F259AA1B33AC44F89FEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp4A15.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp4A15.tmp.exe
Size 29KB
SHA256 d3cf09c638fb94b81343c94dd1a9d7ee385a5240a1f3d78fc70dc591b417999d
MD5 a7a746707ca4e136585570eef6daf2d4
SHA1 50705953b5184d8c0fea9c10619d765648976b78
SHA512 dc97a3cdeb599c976bac9ef4e901c97e4bf02035b6ea60c0e8d9a288b220ca66545a4810842623574293ff09bd4c60fdfaa878fd4e7aa2dbd493d4f001fb0ce5
SSDEEP 384:Af/GMPhe22EjYdr1M8KdkMLk24jXPlCuoM/SYNp0DDZ3:eGq0dr1M8Kdkg2XPdS3
TLSH
T109D23D2752CEBEE6C9B90670373343C1D36DDE045413DA2E99D4B52AD9BE2037A927C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 354B
SHA256 b7528dce3169fa49b584606508750d340cad1e3d66ff1f8903e59b961e78e3c1
MD5 6af186853f93b5edf01154bcd5f95f6e
SHA1 862445f975719df6cb853f31e06b2e832cc339b8
SHA512 b59468d8ef5bd47c550ea6477766705e9baa7337f6eb6200b513902f4303bb46476bfdf22c4b06b3656420fde60c130adbe4b1409ec1ef9e2d15eb5f9756d083
TLSH
T140E01A537752E3E9A3BEA19539B99CF09BF24C9CEA9D022108EC2C900D50983A69708D
MD5 SHA1 SHA512 TLSH

Submit Download

app

Path C:\Users\Admin\AppData\Roaming\app
Size 5B
SHA256 9c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5
MD5 c2844bc9e1bd64168a727b0680ae4d90
SHA1 7bb263540de557f5a4e09c6c78b7dbb314a0df9a
SHA512 360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed
MD5 SHA1 SHA512

Submit Download

memory/720-0-0x00000000011D0000-0x00000000011E0000-memory.dmp

Download

memory/720-1-0x0000000074782000-0x0000000074784000-memory.dmp

Download

memory/4840-17-0x0000000074780000-0x0000000074DA1000-memory.dmp

Download

memory/4840-13-0x0000000074780000-0x0000000074DA1000-memory.dmp

Download

memory/4840-18-0x0000000074780000-0x0000000074DA1000-memory.dmp

Download

memory/4840-12-0x0000000074780000-0x0000000074DA1000-memory.dmp

Download

memory/4840-16-0x0000000074780000-0x0000000074DA1000-memory.dmp

Download

memory/4852-58-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-57-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-19-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-24-0x00007FF901890000-0x00007FF9018A0000-memory.dmp

Download

memory/4852-25-0x00007FF901890000-0x00007FF9018A0000-memory.dmp

Download

memory/4852-21-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-23-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-60-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-59-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-20-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4852-22-0x00007FF9042C0000-0x00007FF9042D0000-memory.dmp

Download

memory/4940-71-0x0000000000B50000-0x0000000000B5E000-memory.dmp

Download

memory/4940-72-0x0000000005610000-0x00000000056AC000-memory.dmp

Download

memory/4940-73-0x0000000005CB0000-0x000000000626A000-memory.dmp

Download

memory/4940-74-0x0000000005790000-0x0000000005822000-memory.dmp

Download

memory/4940-75-0x0000000005720000-0x000000000572A000-memory.dmp

Download

memory/4940-76-0x0000000005830000-0x0000000005886000-memory.dmp

Download