njrat | c328d69c96ff5904aa4b99d53dc13e7f3eaea392105f9b1c2a034d129829ac36

Analysis

user interaction
yes
max time kernel
18s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VoiceChanger64f.exe
Size 1.4MB
Sample261111-v99veaag89
SHA256 c328d69c96ff5904aa4b99d53dc13e7f3eaea392105f9b1c2a034d129829ac36
MD5 2ac93c79b3fcff3cd18fc1f0614406c0
SHA1 9e1c9bae51e4f43759abf25d251b82a24efdcd70
SHA512 1012e6f467ee505c4c2fcc428e91ecf66ab27c8befe8e9abc140967f2c6c7cb861155d0bc9b409873b2a89d16fca9a504b39774fb2d1159a2590fa79455e386f
SSDEEP 24576:lM7RA77So0CxBF5hVqg7yRYl2uqKJ70VqUMHXsktkhd9oqM4Mo7GLVX4/xDT:+bdCxRK0y+l2Bs7sqUMHwhd9oCgI5/
TLSH
T10D6512D3FDA45E43EFEF823A5BF164A00A86C6969341C9DF7E41A54A38FA214CD33641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim defense_evasion discovery execution njrat trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

xy16nq4agh.localto.net:8294

Mutex

5bd64af1d4eb96cfea1e252a1439239b

Attributes

reg_key
5bd64af1d4eb96cfea1e252a1439239b
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	VoiceChanger64f.exe

Executes dropped EXE 2 IoCs

pid	Process
4800	VoiceChanger64f(2.10).exe
3500	VoiceChanger64.exe

Loads dropped DLL 2 IoCs

pid	Process
4800	VoiceChanger64f(2.10).exe
4800	VoiceChanger64f(2.10).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2324	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	VoiceChanger64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	VoiceChanger64.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoiceChanger64f(2.10).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VoiceChanger64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1824	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	3500	VoiceChanger64.exe
Token: 33	3500	VoiceChanger64.exe
Token: SeIncBasePriorityPrivilege	3500	VoiceChanger64.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4800	4804	VoiceChanger64f.exe	83
PID 4804 wrote to memory of 3500	4804	VoiceChanger64f.exe	84
PID 3500 wrote to memory of 1664	3500	VoiceChanger64.exe	90
PID 3500 wrote to memory of 2324	3500	VoiceChanger64.exe	92
PID 2324 wrote to memory of 1824	2324	cmd.exe	94

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1664	attrib.exe

C:\Users\Admin\AppData\Local\Temp\VoiceChanger64f.exe
"C:\Users\Admin\AppData\Local\Temp\VoiceChanger64f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4804
- C:\ProgramData\VoiceChanger64f(2.10).exe
  "C:\ProgramData\VoiceChanger64f(2.10).exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4800
- C:\ProgramData\VoiceChanger64.exe
  "C:\ProgramData\VoiceChanger64.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\ProgramData\VoiceChanger64.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Wireshark.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Wireshark.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoiceChanger64.exe

Path C:\ProgramData\VoiceChanger64.exe
Size 54KB
SHA256 aa38ad7968f89b76c9357dff7b48a7f52c212a98c475f1d17b9cc1ebc8b46d58
MD5 8085f138157c6b87d8b6c85665ddc93f
SHA1 5a57578937d713065e209546cf227274507a8d8a
SHA512 eaaf03a6f54c7d07a15aad672155a22bc1106a2169eba24dc4cf27bb50462241e9c2bf96249a24beff0fd4ca07e72a05e399ccab0be7fe5bb5fd8a5dc894447f
SSDEEP 1536:PHtIDnrNZ9LyDBIDKwsNMD4AXExI3pm4m:VIDnhelIDKwsNMD4AXExI3pm
TLSH
T147434A44BFEA4A05E2BD8F3468F655150A30BA63E632EB1E4CD668DB17327C58C40FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VoiceChanger64f(2.10).exe

Path C:\ProgramData\VoiceChanger64f(2.10).exe
Size 1.3MB
SHA256 e3d46764e53f3c1afeffd78e660663d5b6eeb2020119cf4cb2e63e8db7d16856
MD5 3398849b62e4654f7742e6d7d393af4b
SHA1 e0681e394665b5015a76b3b14177a1bf4d373a3f
SHA512 533014d80ecf5438a280e6861ba58a678f52b99553cd244026c3d661b36e9bd2f4eb2abd485855f8e5f93bfd07f1eb0680d63d80399cc783e9a11b1fe1555df6
SSDEEP 24576:QYDwMU89daU1Fj1PDvUFMRblCAfyW2K9wWhNtgg/5ubK2GOkFIuNj25Zc:RkL89oU1F57v3io21WigQKI0
TLSH
T1195533517BD0D06AEEEA82B15BFCB33F3AFBA83E8D15544356354D7E9086D0ADA06310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nshC929.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nshC929.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nshC929.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3500-20-0x0000000001570000-0x0000000001580000-memory.dmp

Download

memory/3500-21-0x0000000074C82000-0x0000000074C84000-memory.dmp

Download

memory/3500-35-0x0000000001570000-0x0000000001580000-memory.dmp

Download

memory/3500-36-0x0000000074C82000-0x0000000074C84000-memory.dmp

Download

memory/4804-0-0x0000000000E40000-0x0000000000FAC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads