njrat | eb0ce85631d01c535145780a5e63822193b20f7b466d3b614dccf8963f8a34ca

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/11/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Torrent (1).js
Size 67KB
Sample261114-d65b3sct2y
SHA256 eb0ce85631d01c535145780a5e63822193b20f7b466d3b614dccf8963f8a34ca
MD5 f8c79c6ada281fa707d1c34e0a7108f8
SHA1 b480bf7edc52e8576fff935884c6a5ca4fee9cd2
SHA512 55830e8fd0bad9cfaa7fe57d3222583043cdf5aabcc55598fabd152d2bee9ef14e7cf3bc3cc6240a894b9296d409b95fcf20d6e80ed34e0e9ddbae1cfbc37a66
SSDEEP 1536:8z/aOdxDnBWFmYLgum7Xm/3v4pLK+s5tx+uwTbEK0bbqMUH:0/r7sLguisA8+sVG5
TLSH
T151639EC9B48A64D4BAE58BF47FDE7F5BC5AB10A32C50FD0E7010A2744E106B99A5ED20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

honeysteam defense_evasion discovery execution njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

honeysteam

steamupdate.ydns.eu:5553

Mutex

dc2b30d9dc167c8d0747aeab32b0a469

Attributes

reg_key
dc2b30d9dc167c8d0747aeab32b0a469
splitter
|'|'|

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2332	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
1144	oG5dOp5x.exe
252	oG5dOp5x.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\oG5dOp5x = "C:\\Windows\\oG5dOp5x_cache\\oG5dOp5x.exe"	wscript.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\oG5dOp5x_cache\oG5dOp5x.exe	wscript.exe
File opened for modification	C:\Windows\oG5dOp5x_cache	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	oG5dOp5x.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	oG5dOp5x.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oG5dOp5x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oG5dOp5x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe
Token: 33	1144	oG5dOp5x.exe
Token: SeIncBasePriorityPrivilege	1144	oG5dOp5x.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 1144	4188	wscript.exe	88
PID 1144 wrote to memory of 2332	1144	oG5dOp5x.exe	91

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Torrent (1).js"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\oG5dOp5x.exe
  "C:\Users\Admin\AppData\Local\Temp\oG5dOp5x.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\oG5dOp5x.exe" "oG5dOp5x.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2332

C:\Windows\oG5dOp5x_cache\oG5dOp5x.exe
C:\Windows\oG5dOp5x_cache\oG5dOp5x.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oG5dOp5x.exe

Path C:\Users\Admin\AppData\Local\Temp\oG5dOp5x.exe
Size 23KB
SHA256 48715d7350b26e1b0e7a9bc1bcf6c162809e4b2c5bcbf699cafed73a82ba027c
MD5 7c1a8272653b3f3eb9fb3ea1f3ad7055
SHA1 42205d04ae03523dcfa12c2250802b70e7f536f4
SHA512 0a76ecef1ff29223d05f90d293b4b8efe582cb89c8a574d665fd1cfe21604fdcc2bd2af99f559a8d7c3aa7d5a22edfe32e92697978028d90e466e782c6143d84
SSDEEP 384:5Bs2aUrue9Bx0RPIxHVSul0M/GrUdw6jgFIqZZj1mRvR6JZlbw8hqIusZzZTc6:5aQ/ok1lzRpcnu8
TLSH
T14FB2194E3FA98856C5BC1B7486A5965003B091870423EE2FCCC560CBAFB37D92D4CAF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-36-0x0000000001640000-0x0000000001650000-memory.dmp

Download

memory/1144-37-0x0000000074642000-0x0000000074644000-memory.dmp

Download

memory/1144-41-0x0000000074642000-0x0000000074644000-memory.dmp

Download

memory/1144-40-0x0000000001640000-0x0000000001650000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads