Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/02/2026, 23:25
General
- Target njRAT0.7dHorrorEdition-BINSlayed.exe
- Size 15.7MB
- Sample260221-3efbbagt9g
- SHA256 b6c8ea821d4ac1817d21c3d022b6c232faae7439f6ed263d9a52b41f4a889c8a
Malware Config
Extracted
-
xworm
-
3.1
-
5.tcp.cpolar.cn:13974
-
voaSVam0CgZITFAw
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
-
njrat
-
<- NjRAT 0.7d Horror Edition ->
-
Victim
-
35.tcp.cpolar.top:12324
-
e95445b77b0c53b2f156db0c662b0914
-
reg_key
e95445b77b0c53b2f156db0c662b0914
-
splitter
Y262SUCZ4UJJ
Signatures
- Detect Xworm Payload 2 IoCs
- Njrat family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Drops startup file 2 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\njRAT0.7dHorrorEdition-BINSlayed.exe"C:\Users\Admin\AppData\Local\Temp\njRAT0.7dHorrorEdition-BINSlayed.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\NjRat 0.7D Horror Edition.exe"C:\Users\Admin\AppData\Roaming\NjRat 0.7D Horror Edition.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Roaming\مستكشف الملفات.exe"C:\Users\Admin\AppData\Roaming\مستكشف الملفات.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Shellhost.exe"C:\Users\Admin\AppData\Roaming\Shellhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Shellhost.exe"C:\Users\Admin\AppData\Roaming\Shellhost.exe" ..1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
NjRat 0.7D Horror Edition.exe
Shellhost.exe
مستكشف الملفات.exe
memory/3128-45-0x0000000005CD0000-0x0000000005D34000-memory.dmp
memory/4420-33-0x0000000000BB0000-0x0000000000BE8000-memory.dmp
memory/4420-44-0x0000000002DB0000-0x0000000002DBC000-memory.dmp
memory/4764-0-0x0000000000C90000-0x0000000001C46000-memory.dmp
memory/4764-32-0x0000000002350000-0x000000000235C000-memory.dmp
memory/4980-36-0x000000001CD20000-0x000000001D1EE000-memory.dmp
memory/4980-37-0x000000001D290000-0x000000001D32C000-memory.dmp
memory/4980-38-0x000000001C720000-0x000000001C728000-memory.dmp
memory/4980-39-0x000000001D4A0000-0x000000001D4EC000-memory.dmp
memory/4980-43-0x000000001DE40000-0x000000001DE4C000-memory.dmp
memory/4980-46-0x0000000001CC0000-0x0000000001CD0000-memory.dmp
memory/4980-35-0x000000001C660000-0x000000001C706000-memory.dmp
memory/4980-34-0x0000000001CC0000-0x0000000001CD0000-memory.dmp
memory/4980-42-0x000000001D4F0000-0x000000001D60E000-memory.dmp