njrat | 316a26455bd06be65b533ba32553e1296ab814cec28c801257e169e656f2f422

Analysis

user interaction
yes
max time kernel
149s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/10/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Server.exe
Size 24KB
Sample261031-sm9vsact2v
SHA256 316a26455bd06be65b533ba32553e1296ab814cec28c801257e169e656f2f422
MD5 86aa64fd11e979cf0eb591a16f2e67ed
SHA1 5c40429ded7e2de20a906dae6047b41e5cfc619b
SHA512 1dd50434bf788ce1ce16ae1f9085125575ebd5697fec42395b4b18caae08d58233650812b5364b32bc3539c1eec2f34a8a0dd1e12f1fc62f58e5d67b2508def6
SSDEEP 384:RiURxJTt/6ECAaWhy/DHNCZElrP10PZWtqO7ctJNl/R3G0CTC2P5kUPeZm9:Rx5tCqxybsU71CWtqO7OZBEVOUPeZc
TLSH
T152B2178A7BF64630C2BD5AB488F3232542B9E7878422C75F4CCD50CF6AA77C45640EE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit hacked defense_evasion discovery execution njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

16.tcp.cpolar.top:14204

Mutex

6b766ee02ac3ad8ec0712520cc427d47

Attributes

reg_key
6b766ee02ac3ad8ec0712520cc427d47
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3740	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
3720	tmp3157.tmp.exe
3836	ds.exe
3288	...exe
4104	...exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6b766ee02ac3ad8ec0712520cc427d47 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2293636880-3790684622-1477845016-1000\Software\Microsoft\Windows\CurrentVersion\Run\6b766ee02ac3ad8ec0712520cc427d47 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Server.exe\" .."	Server.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	mountvol.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4156	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ds.exe
File opened for modification	\??\PhysicalDrive0	...exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Server.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Server.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ds.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1240	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4012	Server.exe
3240	Server.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: SeShutdownPrivilege	4156	powercfg.exe
Token: SeCreatePagefilePrivilege	4156	powercfg.exe
Token: SeShutdownPrivilege	4156	powercfg.exe
Token: SeCreatePagefilePrivilege	4156	powercfg.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe
Token: 33	4012	Server.exe
Token: SeIncBasePriorityPrivilege	4012	Server.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3288	...exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3288	...exe
3288	...exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3740	4012	Server.exe	82
PID 4012 wrote to memory of 3720	4012	Server.exe	87
PID 3720 wrote to memory of 3836	3720	tmp3157.tmp.exe	88
PID 3720 wrote to memory of 3288	3720	tmp3157.tmp.exe	89
PID 3288 wrote to memory of 1240	3288	...exe	90
PID 3288 wrote to memory of 4156	3288	...exe	92
PID 3288 wrote to memory of 4988	3288	...exe	93
PID 3288 wrote to memory of 4408	3288	...exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Windows\SYSTEM32\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Server.exe" "Server.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3740
- C:\Users\Admin\AppData\Local\Temp\tmp3157.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp3157.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Users\Admin\AppData\Roaming\ds.exe
    "C:\Users\Admin\AppData\Roaming\ds.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:3836
- - C:\Users\Admin\AppData\Roaming\...exe
    "C:\Users\Admin\AppData\Roaming\...exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /f /sc minute /mo 1 /tn ".." /tr "C:\Users\Admin\AppData\Roaming\...exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1240
  - - C:\Windows\SYSTEM32\powercfg.exe
      "powercfg" /h off
      4⤵
      Power Settings
      Suspicious use of AdjustPrivilegeToken
      PID:4156
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Z: /s
      4⤵
      PID:4988
  - - C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Z: /d
      4⤵
      Enumerates connected drives
      PID:4408

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe" ..
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:3240

C:\Users\Admin\AppData\Roaming\...exe
C:\Users\Admin\AppData\Roaming\...exe
1⤵
- Executes dropped EXE
PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3157.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp3157.tmp.exe
Size 1.4MB
SHA256 be3c18b3f7eba83d10e7326a12e62052a8d23d9fb779eb8ba2a14e035c8f7a99
MD5 8c9e67f64f13d0431e7bc51a652fe03b
SHA1 cb52fd52c0dc555e3d26f72c828db13717183559
SHA512 ea8004870dee9f6a7a2312136ce36cb49207d86c09db17caf619b062dfab81e3495704cc63ed04f40634f4da928c63a8705a87a82e8afaa7c863be7845131707
SSDEEP 24576:o6/BO8FrFzV39v7+mEs+CCDjFI4VcM0jhx:o0vRkmiFVc
TLSH
T18765AE5D6702F66FCC686BB5D056F87CD2423DB2B63F590A24C8BF57BA734A30906029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

...exe

Path C:\Users\Admin\AppData\Roaming\...exe
Size 14KB
SHA256 48716378c35eabf4e69fa0383961ec85623ee2d9ca4356fb79e9e9b1a68d3499
MD5 43d99d377b31176d65cca6bd06c8b4f3
SHA1 d85b44bf2875cb22db337cc93fdb4037ce3d7ae9
SHA512 7be976f322fc8351246ee91011cec98177925ad411f9a4ace6a8e9626df9d882aaced9e7762ec8eae75cfcec79c362c5628ae48ee8d07fc61d665a4206a41db3
SSDEEP 384:k2KN7TrZumZOLoTer9ZSZwnZFJt0Bgr9Y4:DydIr9TCL4
TLSH
T14D621904EBE88794EABD0F396DF313664231E4E3D903CB8D18E4025B7E70BD59610BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds.exe

Path C:\Users\Admin\AppData\Roaming\ds.exe
Size 1.2MB
SHA256 4d1095083d9571c0edffe9f50806a12b99b0bcec97043915b945ffeeb8756768
MD5 57743c009712a0277caa5b6b7b65ce94
SHA1 4c8b9d882591daf0296e58603c01526c52dc672c
SHA512 647a9970f8b4f8f27e4a9e051deefbd347c4ace1bd1ca1352e20f74e49b0747403eb847bd2e1f9f669c968059096ae878637458d78ca02cf871a899ecbf94a9f
SSDEEP 12288:OADFlM9syxJoFhkj1bLB5v5M9syxJoFhkj1bLB5v5M9syxJoFhkj1bLB5v8zk/d6:oyyk+b95Wyyk+b95Wyyk+b959dkBbj
TLSH
T15645D0466A748C49C6A51BFC1A31D97D926E9E252CF5420FB1F6FE6BFB322C62C43041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3288-41-0x0000000000CB0000-0x0000000000CBA000-memory.dmp

Download

memory/3720-17-0x000000001BD30000-0x000000001BE70000-memory.dmp

Download

memory/3720-16-0x0000000000DD0000-0x0000000000F48000-memory.dmp

Download

memory/3836-42-0x0000000000AA0000-0x0000000000BDE000-memory.dmp

Download

memory/3836-43-0x0000000005AB0000-0x0000000006056000-memory.dmp

Download

memory/3836-44-0x00000000055A0000-0x0000000005632000-memory.dmp

Download

memory/3836-45-0x0000000005850000-0x000000000585A000-memory.dmp

Download

memory/4012-0-0x0000000000A90000-0x0000000000A9C000-memory.dmp

Download

memory/4012-4-0x000000001BA20000-0x000000001BA2A000-memory.dmp

Download

memory/4012-2-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

Download

memory/4012-1-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads