Analysis
- geolocation tags
- max time kernel
60s - max time network
35s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 10:24
General
- Target NinjaCS_v1.8.exe
- Size 1.9MB
- Sample260701-mflaysdy5v
- SHA256 0808ecbe49323d7bb321045422ec0e1a92e67bcffe2b9bbfaa877453f216556d
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NinjaCS_v1.8.exe"C:\Users\Admin\AppData\Local\Temp\NinjaCS_v1.8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\NinjaCS.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\NinjaCS.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HandyControl.dll
strings.json
Newtonsoft.Json.dll
NinjaCS.exe
memory/3376-43-0x000001F375140000-0x000001F3751F2000-memory.dmp
memory/3376-47-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-37-0x000001F375250000-0x000001F375414000-memory.dmp
memory/3376-38-0x000001F35C8C0000-0x000001F35C97A000-memory.dmp
memory/3376-40-0x000001F35C800000-0x000001F35C83E000-memory.dmp
memory/3376-41-0x000001F35C610000-0x000001F35C61E000-memory.dmp
memory/3376-34-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-39-0x000001F35C600000-0x000001F35C608000-memory.dmp
memory/3376-33-0x000001F35A780000-0x000001F35A7FE000-memory.dmp
memory/3376-44-0x000001F35C840000-0x000001F35C862000-memory.dmp
memory/3376-32-0x00007FFB2BC5F000-0x00007FFB2BC60000-memory.dmp
memory/3376-35-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-48-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-49-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-50-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-51-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-53-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-54-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-55-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-56-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp
memory/3376-57-0x00007FFB2BAD0000-0x00007FFB2C474000-memory.dmp