njrat | 66bcca7240becffc823b49f98ed3ba5e595ca5973c166242546cb267753973db

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EAX settings.exe
Size 1.2MB
Sample261105-ndewtshy41
SHA256 66bcca7240becffc823b49f98ed3ba5e595ca5973c166242546cb267753973db
MD5 cf9a745661e96ce7fe70abb686283469
SHA1 7a3eac125b6d927d7876b5ac95c2e0e26068cff5
SHA512 cd6fa3a00c63eb6d10c75ddd4fe3c3928524b0dc00b5612282b0123193a7c4224129df13015efea446b5c4c9753fb94622a85fa8c3b24327eef3f8d0ead63fa3
SSDEEP 24576:nZr5Ci4T0sbugWUW8kqhgXvy0W31LhU+tf+Y1ymL:ZlClXugfMHW3QI+Y1ymL
TLSH
T12145F1D2E188D1D9EC6E5A7255270CF101E73C7FC9E1659D61EFB22691B32C3012BA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim discovery njrat trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

127.0.0.1:25565

Mutex

5102781006bd20812f329e59b82f04f4

Attributes

reg_key
5102781006bd20812f329e59b82f04f4
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 2 IoCs

pid	Process
3324	Payload.exe
4140	EAX Console.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2388	4140	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EAX Console.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe
Token: 33	3324	Payload.exe
Token: SeIncBasePriorityPrivilege	3324	Payload.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3324	2600	EAX settings.exe	89
PID 2600 wrote to memory of 4140	2600	EAX settings.exe	90

C:\Users\Admin\AppData\Local\Temp\EAX settings.exe
"C:\Users\Admin\AppData\Local\Temp\EAX settings.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
  "C:\Users\Admin\AppData\Local\Temp\EAX Console.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 940
    3⤵
    - Program crash
    PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4140 -ip 4140
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EAX Console.exe

Path C:\Users\Admin\AppData\Local\Temp\EAX Console.exe
Size 2.0MB
SHA256 67f4ee97a3b3cc90ebc82b2f9fe49f84c8c1099c81061ddc8d30bc3b6cd1e587
MD5 40a2fd8c7f902b9720ea9c9d6f1d1378
SHA1 bcacdcf72f283098fa5f3b9f234113aa5175f2a6
SHA512 afec05d1ee88573e71220862181c62e78f92520694dceec96776087e6f4ae1eab07ddb0074598309b89556cf9071c4245bd11a23b5bd11ae7b559dfe72f8cdbe
SSDEEP 49152:WsCKIuxgaMj3XRD+uj3H2Cuk1+Lda3WvhoUo5c0XWzoZsCKBmL:WsCKIkDMj3XZ+ujX2Cuk1+Lda3Wvho6C
TLSH
T1E79538D2EA4482D5ED3E47B3B0275CF116A33C7EEAF4649D248DB92649B3253442F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Payload.exe

Path C:\Users\Admin\AppData\Local\Temp\Payload.exe
Size 55KB
SHA256 901bf80303f2ffe8669932e16b74816b1887eb25343afcb5cfde3d9619de11a1
MD5 e605864dccf796f375a028d52123b149
SHA1 3a9cde22a24c44a22547650a60b4d201fa498ae5
SHA512 3bd9f0aeb3691271b8b79c25a7b584ad91717be22f5426afa8966820524b2f0592416b0ac9322e69a6cd670c5738e89a27395ff12a590721eb6c843d32f62c56
SSDEEP 1536:vPt4DnCnNgV6SRvQDFwsNMDhXExI3pm6m:t4DnC2flQDFwsNMDhXExI3pm
TLSH
T18A431844BFEA5A01E2BD8F3468F655150A34AA23F532EB1E48D668DB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2600-25-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/2600-1-0x00000000009D0000-0x0000000000B02000-memory.dmp

Download

memory/2600-2-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/2600-3-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/2600-5-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/2600-6-0x00007FFDAB2E0000-0x00007FFDABC84000-memory.dmp

Download

memory/2600-0-0x00007FFDAB46F000-0x00007FFDAB470000-memory.dmp

Download

memory/3324-23-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/3324-24-0x0000000074DF2000-0x0000000074DF4000-memory.dmp

Download

memory/3324-29-0x0000000000E30000-0x0000000000E40000-memory.dmp

Download

memory/4140-26-0x0000000000DE0000-0x0000000000FDA000-memory.dmp

Download

memory/4140-22-0x0000000074642000-0x0000000074643000-memory.dmp

Download

memory/4140-27-0x0000000005F00000-0x00000000064BA000-memory.dmp

Download

memory/4140-28-0x00000000059E0000-0x0000000005A72000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads