Analysis
- max time kernel
900s - max time network
902s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 19:12
General
- Target 4423.exe
- Size 55KB
- Sample260924-xwkpgagh28
- SHA256 5b192a11bec82d09ed75dd2ccc328648a10a1b5ff1ce0d82624ab1658cf86341
Malware Config
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 1 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4423.exe"C:\Users\Admin\AppData\Local\Temp\4423.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\2650873"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\19fb7588f242454d930720fa9e2afbc9.exe"C:\Users\Admin\AppData\Local\Temp\19fb7588f242454d930720fa9e2afbc9.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\2744155"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
19fb7588f242454d930720fa9e2afbc9.exe
memory/704-4-0x0000000000400000-0x0000000000472000-memory.dmp
memory/2260-26-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-32-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-41-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-40-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-39-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-38-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-18-0x00007FFA638AA000-0x00007FFA638AB000-memory.dmp
memory/2260-19-0x000000001BE20000-0x000000001BEC6000-memory.dmp
memory/2260-20-0x000000001C3E0000-0x000000001C8AE000-memory.dmp
memory/2260-21-0x000000001C970000-0x000000001CA0C000-memory.dmp
memory/2260-22-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-23-0x0000000001CC0000-0x0000000001CC8000-memory.dmp
memory/2260-24-0x000000001CC20000-0x000000001CC6C000-memory.dmp
memory/2260-25-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-37-0x00007FFA638AA000-0x00007FFA638AB000-memory.dmp
memory/2260-36-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-34-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-29-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-30-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-31-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-27-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-33-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-28-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/2260-35-0x00007FFA635B0000-0x00007FFA63FE8000-memory.dmp
memory/5620-1-0x0000000075062000-0x0000000075064000-memory.dmp
memory/5620-3-0x0000000075062000-0x0000000075064000-memory.dmp
memory/5620-0-0x0000000001510000-0x0000000001520000-memory.dmp
memory/5620-7-0x0000000075060000-0x0000000075681000-memory.dmp
memory/5620-6-0x0000000075060000-0x0000000075681000-memory.dmp
memory/5620-2-0x0000000001510000-0x0000000001520000-memory.dmp