njrat | b258d87458f2c36d1d07ab4fc17a49b34966ff05a0226b8156614796c0c945bf

Analysis

max time kernel
34s
max time network
59s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
script.ps1
Size 188B
Sample261020-mjsjfayvfv
SHA256 b258d87458f2c36d1d07ab4fc17a49b34966ff05a0226b8156614796c0c945bf
MD5 45edb364869aceb5f7f2539e3c6d20de
SHA1 330f4780c2bc953660027616f48b00d53d31339b
SHA512 a3ff0362f6546ebbd34a945ef48bbf2a2437d2ce1e529d213d39d06b3ec43b5e222727c0fe383f1dc1460fae2b3c4f0a6b363a2e8c10c187e752a2a7970174bb
TLSH
T119C02221E088016E9D2A2083B960770A82C18008A8C41DA1C5EA4C0121002C223EA080
MD5 SHA1 SHA512 TLSH

Score

10^/10

dlgeded defense_evasion discovery execution njrat trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

dlgeded

23.95.31.196:13623

Mutex

4dae6979cd8f84331147677e76fd3205

Attributes

reg_key
4dae6979cd8f84331147677e76fd3205
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2200	PowerShell.exe
3	2200	PowerShell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	2200	PowerShell.exe

Executes dropped EXE 3 IoCs

pid	Process
5756	mshalb67.exe
5044	3437574c3249457ca668d10fd0fe58ce.exe
2888	0115b1d9158a46bc8f433d9607ddb696.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	mshalb67.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2200	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4200	cmd.exe
1132	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshalb67.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshalb67.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshalb67.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dsn	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\MSPaint.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.kci	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.nls	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.appcontent-ms\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.camp	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ics	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4v	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.arw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.heic\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.opus\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.contact\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dotx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.man	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.onepkg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pef\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ods\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cur\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mos	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\IExplore.exe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.b4s	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ghi\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iiq	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2TS\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.png\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.api\AcroExch.Plugin	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dot	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\OpenWithProgids	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.odt\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.inv\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2TS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mhtml	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.perfmoncfg	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mef\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.onetoc2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.htx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.obj\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.faq\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.heic\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.lst	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.arc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.Job	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogv\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.AAC	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADT	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ics\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.idq\PersistentHandler	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2200	PowerShell.exe
2200	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	PowerShell.exe
Token: SeDebugPrivilege	5756	mshalb67.exe
Token: 33	5756	mshalb67.exe
Token: SeIncBasePriorityPrivilege	5756	mshalb67.exe
Token: 33	5756	mshalb67.exe
Token: SeIncBasePriorityPrivilege	5756	mshalb67.exe
Token: 33	4076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4076	AUDIODG.EXE
Token: 33	5756	mshalb67.exe
Token: SeIncBasePriorityPrivilege	5756	mshalb67.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 5756	2200	PowerShell.exe	90
PID 5756 wrote to memory of 5044	5756	mshalb67.exe	92
PID 5044 wrote to memory of 5196	5044	3437574c3249457ca668d10fd0fe58ce.exe	93
PID 5756 wrote to memory of 2888	5756	mshalb67.exe	95
PID 5044 wrote to memory of 4200	5044	3437574c3249457ca668d10fd0fe58ce.exe	97
PID 4200 wrote to memory of 1896	4200	cmd.exe	99

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\mshalb67.exe
  "C:\Users\Admin\AppData\Local\Temp\mshalb67.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Users\Admin\AppData\Local\Temp\3437574c3249457ca668d10fd0fe58ce.exe
    "C:\Users\Admin\AppData\Local\Temp\3437574c3249457ca668d10fd0fe58ce.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" vbscript:Execute("msgbox ""You Hacked By Shay7lebb"", 48, ""Warning"":close")
      4⤵
      PID:5196
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        5⤵
        Modifies registry class
        
        PID:1896
- - C:\Users\Admin\AppData\Local\Temp\0115b1d9158a46bc8f433d9607ddb696.exe
    "C:\Users\Admin\AppData\Local\Temp\0115b1d9158a46bc8f433d9607ddb696.exe"
    3⤵
    - Executes dropped EXE
    PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c start shutdown /s /f /t 0
    3⤵
    - Executes a command shell one-liner
    PID:1132
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 0
      4⤵
      PID:4832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x0000000000000498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2e855 /state1:0x41c64e6d
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0115b1d9158a46bc8f433d9607ddb696.exe

Path C:\Users\Admin\AppData\Local\Temp\0115b1d9158a46bc8f433d9607ddb696.exe
Size 11KB
SHA256 19e7858f735b00f010959ddceb45465e30ef84f9d975d266ffbf63e6a73abdb5
MD5 252cd48a417acfa3fce8616f2679142b
SHA1 57f0f1976c4e434dc5e0210207fceef1f9c0e430
SHA512 94cb5c5a91eed71b2265d8e92b5e7e517321f7cd9b36e448dbe872e1da362e1ce38b2d4b3f3e5879a1e004edc95db7caeb22998bf20c36756e02660720e8fac0
SSDEEP 192:Y2yLlJRjc5kqJAQebmjsTrtSiV9oO+MX:Y9LlJR2NJJebQsHtSi//
TLSH
T19B32F70C67E88924E5BE4B7218B7C61147B0F0038E27CF5E1DDE9CEE1E667216576B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3437574c3249457ca668d10fd0fe58ce.exe

Path C:\Users\Admin\AppData\Local\Temp\3437574c3249457ca668d10fd0fe58ce.exe
Size 12KB
SHA256 121dbce9a60d8f122d22cde73678b511c31e3168dea67a5b01944c0dd7160792
MD5 ed6fe70c8ae9bab054a55f894deb2dfb
SHA1 48da88e4eea3e45a304f2cab139d25a0606020cc
SHA512 daed26a779fc534da69728f1f918c0057801f370e01fe3be2446036050eccdb09286024fc4026b1dbe79fc0f83014bfa7ef50d0967d57a48b4c4dbd1175ea10f
SSDEEP 192:BxCCVwsjHMGzW6sfSurf11eb7vptT5avt2rXbEILcOGzbP:B0BGHMGC6sfZrf/eb7DT5It2rXLcOGf
TLSH
T1BD423C46BFD68830C5AD0B3D287747D56A30A44A8A33DB5E1DCD81BB5E767480EC86F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_e0ch5ely.yzv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e0ch5ely.yzv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mshalb67.exe

Path C:\Users\Admin\AppData\Local\Temp\mshalb67.exe
Size 55KB
SHA256 10899fbf7ad1a6debd6fcd0f00de18478f9a773f88f417839badbd70e4cf6815
MD5 7a172a793cbca69dced58d06092e62ae
SHA1 d3da233327d70879ee7586dbd2a84999d9bbf63c
SHA512 a740ece5a9b3df9421b6485121d76eb37e1f974a2f065d72a400590046ad5814ef90c471efab53454aea279dd032518e816c54b5b034ec88597fa2bd5d79873b
SSDEEP 1536:pzYADnG5N3HSdfd7ED9wsNMDyXExI3pmmm:yADn0ydtED9wsNMDyXExI3pm
TLSH
T1F3431744BFEA4A01E2BD8F3469F655150634BA23F532EB1E88D568EB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2200-15-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-7-0x000002126A550000-0x000002126A572000-memory.dmp

Download

memory/2200-11-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-12-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-13-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-14-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-0-0x00007FF9937EF000-0x00007FF9937F0000-memory.dmp

Download

memory/2200-9-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-25-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-10-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2200-1-0x00007FF993660000-0x00007FF994004000-memory.dmp

Download

memory/2888-54-0x0000000000760000-0x000000000076A000-memory.dmp

Download

memory/5044-42-0x0000000000230000-0x000000000023A000-memory.dmp

Download

memory/5756-26-0x00000000013C0000-0x00000000013D0000-memory.dmp

Download

memory/5756-31-0x00000000751B0000-0x00000000757D1000-memory.dmp

Download

memory/5756-30-0x00000000751B0000-0x00000000757D1000-memory.dmp

Download

memory/5756-29-0x00000000751B2000-0x00000000751B4000-memory.dmp

Download

memory/5756-28-0x00000000013C0000-0x00000000013D0000-memory.dmp

Download

memory/5756-27-0x00000000751B2000-0x00000000751B4000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads