njrat | 7c87f6a9e89603fc8398cc8dc598f74ed509c8058aafeab5f88b0a249549e813

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 31KB
Sample261014-cs7dvaxtcs
SHA256 7c87f6a9e89603fc8398cc8dc598f74ed509c8058aafeab5f88b0a249549e813
MD5 17ac7c0d93a41c1b309c26d7e5b0d597
SHA1 7af41f196e8830370c48b06c376c46cee6f4444d
SHA512 65966b693f721a926621c38e29e498f1b517436d1cb1bb4e322cfde53f9e470b1c86023e14f003bcba9f4a3ec7a4310ff674301c7cf9d5aeaef6765a530476cb
SSDEEP 768:GXJEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tiXAjj:9D6uukAbiT6oQVkEij
TLSH
T117E21BADFBEA4466D1BC0AB50671950013B4D103E523F77E4ECA24A62B6B7D84B84DF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5388	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: 33	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Token: SeIncBasePriorityPrivilege	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 5388	5384	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe" "jaffacakes118_HEUR.Trojan.Win32.Generic.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5388