njrat | 652aab2d537e3d581b2b58ace9733ee3ee8e9500143bc9e28d5caa4bfc7f8b25

Analysis

user interaction
yes
max time kernel
150s
max time network
146s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P2.exe
Size 2.0MB
Sample260930-vd64msseme
SHA256 652aab2d537e3d581b2b58ace9733ee3ee8e9500143bc9e28d5caa4bfc7f8b25
MD5 3bc8f2226f3502ed98803525e4eb6c4f
SHA1 daf795a5012d382ef06029b33d3661ec04d773d0
SHA512 96c6c98bac3222e623ba90e30a1cdc74b3f93e6c22e672e3e73a27acb29830b418c2e6b4c4b1c2a0c709f8bbf788c6e0bdabb0e5c8c5c4eefe6e1b28790aa0eb
SSDEEP 49152:OM+doxUyNlh3Kx1yVg0lj5lch3vqpcwrJT6C32SlUi:OvKxUyNmSVg0lXcpvdM9B3L
TLSH
T10B95339448412D30D9F0FF320D16FAA78DADDC595224C013AB8FEFDA53961E68D29BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	P2.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2140	netsh.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	P2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	P2.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\10011c197e38e8a1f43f54f065c97bdf.exe	P2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\10011c197e38e8a1f43f54f065c97bdf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\P2.exe\" .."	P2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\10011c197e38e8a1f43f54f065c97bdf = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\P2.exe\" .."	P2.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	P2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1028	P2.exe
2468	P2.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	P2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	P2.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1028	P2.exe
1028	P2.exe
2468	P2.exe
2468	P2.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe
Token: 33	1028	P2.exe
Token: SeIncBasePriorityPrivilege	1028	P2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2140	1028	P2.exe	89

C:\Users\Admin\AppData\Local\Temp\P2.exe
"C:\Users\Admin\AppData\Local\Temp\P2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\P2.exe" "P2.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2140

C:\Users\Admin\AppData\Local\Temp\P2.exe
"C:\Users\Admin\AppData\Local\Temp\P2.exe" ..
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-14-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-8-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-2-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-4-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-1-0x0000000076160000-0x0000000076161000-memory.dmp

Download

memory/1028-5-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-7-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-21-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-9-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/1028-10-0x0000000076160000-0x0000000076161000-memory.dmp

Download

memory/1028-11-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-12-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-3-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-0-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/1028-15-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/1028-16-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-26-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-22-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-17-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/2468-19-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-18-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-25-0x0000000000400000-0x00000000009E8000-memory.dmp

Download

memory/2468-20-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-27-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-28-0x0000000076140000-0x0000000076230000-memory.dmp

Download

memory/2468-31-0x0000000076140000-0x0000000076230000-memory.dmp

Download