njrat | 10b1673a3107f3811accbaa13a0c4e243543585751e4bb276cdca085caff0f25

Analysis

user interaction
yes
max time kernel
81s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/11/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payload.exe
Size 55KB
Sample261109-wp49vshb83
SHA256 10b1673a3107f3811accbaa13a0c4e243543585751e4bb276cdca085caff0f25
MD5 1339a158fe9a874f9eb2d97f3afd6e94
SHA1 ebfc0933b024161ea61d79398179d40893626351
SHA512 fe75d0a3efee7d90e33f04506015aa649925ac5d6978009d9735f956d8165ad84f9c056fa1c959c18ab17094f2b2a7ecc5bc838b98342535bfb5e75d7f57401f
SSDEEP 1536:fMZMDnE4uNhty4X+SChDmwsNMD8XExI3pmkm:yMDnlIk4XohDmwsNMD8XExI3pm
TLSH
T160432744BFEA4A01E2BD8F3468F655150634BA63E532EB1F48D668DB17327C58C80FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery njrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

33.tcp.cpolar.top:12753

Mutex

wmWFkGhexHrBdp93

Attributes

Install_directory
%AppData%
install_file
XWormClient.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024307-16.dat	family_xworm
behavioral1/memory/5056-24-0x0000000000C80000-0x0000000000C92000-memory.dmp	family_xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	Payload.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acad18890e4e0431876f630c266ace7b.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\acad18890e4e0431876f630c266ace7b.exe	Payload.exe

Executes dropped EXE 4 IoCs

pid	Process
5056	08f78e79ffc94b08aa9d7aaa8a24c9fb.exe
1644	29cbf5ce299d4e3fbe238b4a3e0b18d5.exe
2528	49825b2b675b424b95eeb6803463c2c0.exe
4384	f8dfac21439e4a46a378ce7e6e361601.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\acad18890e4e0431876f630c266ace7b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .."	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\acad18890e4e0431876f630c266ace7b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe\" .."	Payload.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
18	ip-api.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f8dfac21439e4a46a378ce7e6e361601.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f8dfac21439e4a46a378ce7e6e361601.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	08f78e79ffc94b08aa9d7aaa8a24c9fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	29cbf5ce299d4e3fbe238b4a3e0b18d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	49825b2b675b424b95eeb6803463c2c0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Payload.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	08f78e79ffc94b08aa9d7aaa8a24c9fb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	29cbf5ce299d4e3fbe238b4a3e0b18d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	49825b2b675b424b95eeb6803463c2c0.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3192	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe
456	Payload.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	Payload.exe
Token: SeDebugPrivilege	3720	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: SeDebugPrivilege	5056	08f78e79ffc94b08aa9d7aaa8a24c9fb.exe
Token: SeDebugPrivilege	1644	29cbf5ce299d4e3fbe238b4a3e0b18d5.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: SeDebugPrivilege	2528	49825b2b675b424b95eeb6803463c2c0.exe
Token: SeDebugPrivilege	4384	f8dfac21439e4a46a378ce7e6e361601.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe
Token: 33	456	Payload.exe
Token: SeIncBasePriorityPrivilege	456	Payload.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 5056	456	Payload.exe	92
PID 456 wrote to memory of 1644	456	Payload.exe	96
PID 456 wrote to memory of 2528	456	Payload.exe	99
PID 456 wrote to memory of 4384	456	Payload.exe	103

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\08f78e79ffc94b08aa9d7aaa8a24c9fb.exe
  "C:\Users\Admin\AppData\Local\Temp\08f78e79ffc94b08aa9d7aaa8a24c9fb.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:5056
- C:\Users\Admin\AppData\Local\Temp\29cbf5ce299d4e3fbe238b4a3e0b18d5.exe
  "C:\Users\Admin\AppData\Local\Temp\29cbf5ce299d4e3fbe238b4a3e0b18d5.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\49825b2b675b424b95eeb6803463c2c0.exe
  "C:\Users\Admin\AppData\Local\Temp\49825b2b675b424b95eeb6803463c2c0.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\f8dfac21439e4a46a378ce7e6e361601.exe
  "C:\Users\Admin\AppData\Local\Temp\f8dfac21439e4a46a378ce7e6e361601.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4384
- C:\Users\Admin\AppData\Local\Temp\0f65420b29094d538791d27db07fb809.exe
  "C:\Users\Admin\AppData\Local\Temp\0f65420b29094d538791d27db07fb809.exe"
  2⤵
  PID:4452
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  PID:3764
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Payload.exe
  2⤵
  - Kills process with taskkill
  PID:3192
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\417c0c9fa2ee4e238fcdb9f5733a9b0b.mp4"
  2⤵
  PID:5048

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe" ..
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Payload.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Payload.exe.log
Size 319B
SHA256 7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
MD5 da4fafeffe21b7cb3a8c170ca7911976
SHA1 50ef77e2451ab60f93f4db88325b897d215be5ad
SHA512 0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6
TLSH
T1EEE07230373284E408203A1008027FDA55FF43576768EE2C1619539EE82A0A7EF102E3
MD5 SHA1 SHA512 TLSH

Submit Download

08f78e79ffc94b08aa9d7aaa8a24c9fb.exe

Path C:\Users\Admin\AppData\Local\Temp\08f78e79ffc94b08aa9d7aaa8a24c9fb.exe
Size 45KB
SHA256 232ee5d3d865583219a94b6509b1dd3ab7cb03cabbeddb782f74097ad72513a0
MD5 2ec036c4406cf857345d616ae960e71d
SHA1 3e3b7efd149e568fe10e0ef84dbeb025bfcda0e9
SHA512 b48fe8cb55b119146dfb7cf2c409ca2118988cbfc25f444f33808a00aa441ba2699dca57489302b02bac37b4177f79dc0acf4d2d1cca371d14974264b7d8d431
SSDEEP 768:nw2JekFqy0377hOklPaG8lsuHFEPr9yJ7OChazjKbc:DJep7h5NaSkFM9yJ7OCkebc
TLSH
T105235B487BD04621E5FEABB46972A9060232E7139913E75E08E493DB1F6B7C08E817D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

417c0c9fa2ee4e238fcdb9f5733a9b0b.mp4

Path C:\Users\Admin\AppData\Local\Temp\417c0c9fa2ee4e238fcdb9f5733a9b0b.mp4
Size 2.1MB
SHA256 6bf69f78dc391f93e81548aeb6714ee140a896c56eff8d24b4a5ad538725b1f0
MD5 83e69fbcd3751c944bc9826563121d00
SHA1 483e6d5c66e7dc11636e75e248e458661134cc7f
SHA512 cb89fe3266312ce2ff37abf579a87dc3132e5ad6a33ef501225dcb8feba5950059b959cdf159b6c7704f4a8418c69fe21a6ec60603975773f6baa402ab793838
SSDEEP 24576:1hogsFlzMkYP+z7u87ixFpW/exSfP3i8abWbXsoC7nr40XKpGFgq0XH5kTKsAJ54:1MPG1gSbYXsJXsGdE5kTRAJ5eC3fHsh
TLSH
T17CA53384279ADED0DB510D7ED9428790359A14B2F053E1DFC3B0A9E90EF90FA8AC35D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

417c0c9fa2ee4e238fcdb9f5733a9b0b.mp4

Path C:\Users\Admin\AppData\Local\Temp\417c0c9fa2ee4e238fcdb9f5733a9b0b.mp4
Size 64KB
SHA256 abe3f07c0ba5a61a1c037327d1206778ec0b695e7eed72b79f533da025af21f6
MD5 343fbdaf706aaaf7f8d86ff0d051756c
SHA1 55ee6eb665f3ae4fe8980e5f43b19058e19dd453
SHA512 997dae32e6057ab7f6ad5529f2dadf222d977b13ee48616eff7853431ac97b59c427ce64575a17c8a317744c2c229843ee989d693f93d25f0f63b758daaab0dc
SSDEEP 1536:PUN1pviEtsibZ+V+MIwbJA6hTABZULwSAP4p5g2QHIYY2qWDVmPzYXE7:1Ets6EV+vQptA/PAo2QrFlVmPYc
TLSH
T14353F1F167312667FB515834A125A32A1C082A74204FFBC6D595E26C7C6C6ECDFA30DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/456-26-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/456-8-0x00000000753C2000-0x00000000753C4000-memory.dmp

Download

memory/456-11-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/456-12-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/456-0-0x0000000001B60000-0x0000000001B70000-memory.dmp

Download

memory/456-38-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/456-5-0x0000000001B60000-0x0000000001B70000-memory.dmp

Download

memory/456-1-0x00000000753C2000-0x00000000753C4000-memory.dmp

Download

memory/3720-10-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/3720-7-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/3720-6-0x00000000753C0000-0x0000000075971000-memory.dmp

Download

memory/5056-24-0x0000000000C80000-0x0000000000C92000-memory.dmp

Download

memory/5056-25-0x000000001B990000-0x000000001B9A0000-memory.dmp

Download