Analysis
- max time kernel
78s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
12/11/2026, 22:31
Errors
General
- Target jra71515.exe
- Size 1.1MB
- Sample261112-2ffsssxt3l
- SHA256 de947beae25bf933df8a1b438c7199248629418750214c0fb87a9158e4a7482b
Malware Config
Extracted
-
njrat
-
<- NjRAT 0.7d Horror Edition ->
-
D.M.e
-
18.tcp.cpolar.top:13330
-
0816db741ccd03ac63dcc9752556d8ac
-
reg_key
0816db741ccd03ac63dcc9752556d8ac
-
splitter
Y262SUCZ4UJJ
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jra71515.exe"C:\Users\Admin\AppData\Local\Temp\jra71515.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jra71515.exe"C:\Users\Admin\AppData\Local\Temp\jra71515.exe"2⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Smil.exe"C:\Users\Admin\Desktop\Smil.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\Desktop\\MasonMBR.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\Desktop\MasonSmil.exe"C:\Users\Admin\Desktop\MasonSmil.exe"4⤵
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004C01⤵
-
C:\Users\Admin\Desktop\MasonMBR.exeC:\Users\Admin\Desktop\\MasonMBR.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
jra71515.exe.log
MasonMBR.exe
MasonSmil.exe
Smil.exe
memory/1396-0-0x00000000002A0000-0x00000000003C0000-memory.dmp
memory/1396-1-0x0000000005060000-0x0000000005070000-memory.dmp
memory/1396-2-0x0000000002880000-0x000000000288A000-memory.dmp
memory/1692-49-0x0000000000410000-0x000000000043E000-memory.dmp
memory/4224-14-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/4224-19-0x0000000005A40000-0x0000000005A50000-memory.dmp
memory/4224-12-0x0000000005A40000-0x0000000005A50000-memory.dmp
memory/4224-13-0x0000000005AF0000-0x0000000005B82000-memory.dmp
memory/4224-10-0x00000000058D0000-0x000000000596C000-memory.dmp
memory/4224-15-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/4224-16-0x0000000006AB0000-0x0000000006AC8000-memory.dmp
memory/4224-17-0x0000000007090000-0x00000000070A8000-memory.dmp
memory/4224-18-0x0000000007050000-0x0000000007072000-memory.dmp
memory/4224-11-0x0000000005F20000-0x00000000064C6000-memory.dmp
memory/4224-20-0x0000000006D70000-0x0000000006D84000-memory.dmp
memory/4224-4-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4224-3-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4224-6-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4224-5-0x0000000000400000-0x0000000000414000-memory.dmp
memory/4616-33-0x00000000013F0000-0x0000000001428000-memory.dmp
memory/4616-50-0x000000001B870000-0x000000001B9BF000-memory.dmp
memory/4616-32-0x0000000000B30000-0x0000000000B90000-memory.dmp