njrat | 4402cb2cf8f0f73324a32e4a82e7e8bdbf521e7efb27e0e03e215617d146c96f

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/10/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OctopusEAX.exe
Size 1.5MB
Sample261025-ydtebssvcs
SHA256 4402cb2cf8f0f73324a32e4a82e7e8bdbf521e7efb27e0e03e215617d146c96f
MD5 22572edac61428be67b29c27b61f8b1e
SHA1 13f0ecde471b7c3d129a86137b6336296409d2cd
SHA512 4515f2133f62d3ff73dafb86da75c63135d2e5a3ad934c40a3e33a62de8990bda529500d9f3d59d2c5e9d362f1b85c75c79e2d05a4357a30439a82c8cc6351fd
SSDEEP 49152:dp1hIRAphJwmy9IB/BlT8Wa/HWOohR+eG9gDk6qmsI:djSRApjs9m/DT8nvPoieGyw
TLSH
T162751232636C50EECBDFCA382ED1C372FFC9445DEC898A49A0EB7447BD9657051019AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim discovery njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

UA3iz-40659.portmap.host:6060

Mutex

a6c56cd45e0a660f227421eb0aa9ddea

Attributes

reg_key
a6c56cd45e0a660f227421eb0aa9ddea
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	OctopusEAX.exe

Executes dropped EXE 2 IoCs

pid	Process
4784	Payload.exe
2368	OctopusEAX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	OctopusEAX.exe
2368	OctopusEAX.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: 33	1680	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1680	AUDIODG.EXE
Token: SeDebugPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe
Token: 33	4784	Payload.exe
Token: SeIncBasePriorityPrivilege	4784	Payload.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4784	3848	OctopusEAX.exe	87
PID 3848 wrote to memory of 2368	3848	OctopusEAX.exe	88
PID 2368 wrote to memory of 1496	2368	OctopusEAX.exe	89
PID 2368 wrote to memory of 4428	2368	OctopusEAX.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe
"C:\Users\Admin\AppData\Local\Temp\OctopusEAX.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Roaming\Payload.exe
  "C:\Users\Admin\AppData\Roaming\Payload.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Users\Admin\AppData\Roaming\OctopusEAX.exe
  "C:\Users\Admin\AppData\Roaming\OctopusEAX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Query /TN "OctopusEAX"
    3⤵
    PID:1496
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Query /TN "MasonEAX"
    3⤵
    PID:4428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OctopusEAX.exe

Path C:\Users\Admin\AppData\Roaming\OctopusEAX.exe
Size 1.4MB
SHA256 6c1758ea8aff65a6f69bfab05752a343077bdffae6873ac1d83dbaa00dc1fc19
MD5 97d1dacc80e013b370e0338c3ecc8782
SHA1 8a5883f4cae22ba72496e6c7086a242c0792e605
SHA512 70c89febda1d2a03f07774b9fb5c98a896e814210d1f3ab35c43de2cf82d87865ddcd014daff294473a6bf7a9dc6b091bfb3fbae92fcb2549267aef18ae927c4
SSDEEP 24576:mWAZU7t1rtbc/7Ydld1asivY1EyVJIRTxNuEagobz32ORV:mT6ptMs1511+5aRz32O
TLSH
T116659E11A1E441EDD1BBE2B4CA762D07E772784103349AEB03D0996A1F277D54EBFB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Payload.exe

Path C:\Users\Admin\AppData\Roaming\Payload.exe
Size 55KB
SHA256 b47f065f69639a3bfb17d5ca3662d2664921a39a01663ef388897aa0e3bf38a1
MD5 a7ee1a64ad1e92148925903472d98132
SHA1 42f284a2147a02c3a6e57679382ec75e8c44798b
SHA512 03a34823fa5f421969569aeeeef77f1b91a68d7533d2ed574110d6cb1212575f5295200859f53f38e7ec106e5842a54060f9e12fac2b4d535d5a378c6d7727d8
SSDEEP 768:SROsVSt1ManUk2N/PSJ2hrcr3UwhkSNAmwFvfu0YMDHPsML7XJSxI3pmxm:SR/gDnqN/PSAqzDVwsNMDDXExI3pmxm
TLSH
T119432844BFEA4A01E2BD8F3468F655150634AA63E932EB1F4CD668DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-0-0x00000000006D0000-0x0000000000856000-memory.dmp

Download

memory/4784-17-0x00000000018A0000-0x00000000018B0000-memory.dmp

Download

memory/4784-18-0x00000000746D2000-0x00000000746D4000-memory.dmp

Download

memory/4784-23-0x00000000018A0000-0x00000000018B0000-memory.dmp

Download

memory/4784-24-0x00000000746D2000-0x00000000746D4000-memory.dmp

Download