njrat | 9a032a14ede36df777cc7d5e17c0feb743447d0e1f5d91a45eda5da869000078

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STOP STORE SCRIPT - V2.exe
Size 5.5MB
Sample260814-lyeqfsgh89
SHA256 9a032a14ede36df777cc7d5e17c0feb743447d0e1f5d91a45eda5da869000078
MD5 54921dc5303e3393d1329384a5d526b4
SHA1 97cf0b24f0eb2b952cf9999630179b7720bb9882
SHA512 137cb15f3861949786b675976ef0e077501c167ddb79afe884ce15cfe25342234d4d7e3848931e63ea2d9db904c92b97180f596e784bc056d5a72026dc3754c1
SSDEEP 98304:DNDnp4Y7vu2IDXeAcWQLYTxCFLQZG0mh14hL1g7m:Dlp4Y70Xq+2yGNhiz
TLSH
T174463344E7D326D6C00AC9740A9BB77D36713EB30460CFAE55947B62ACB2D057A73B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

victim discovery execution njrat persistence trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

27.tcp.cpolar.top:13152

Mutex

998ee04d8e3bb2df42fb10648677ea53

Attributes

reg_key
998ee04d8e3bb2df42fb10648677ea53
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 5 IoCs

pid	Process
4836	System.exe
4540	STOP STORE SCRIPT - V2 (2).exe
4748	System.exe
1800	Payload.exe
2988	System.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe"	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe"	System.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System.exe"	System.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4540	STOP STORE SCRIPT - V2 (2).exe
4540	STOP STORE SCRIPT - V2 (2).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	STOP STORE SCRIPT - V2 (2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3244	schtasks.exe
3460	schtasks.exe
6120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4540	STOP STORE SCRIPT - V2 (2).exe
4540	STOP STORE SCRIPT - V2 (2).exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe
Token: 33	1800	Payload.exe
Token: SeIncBasePriorityPrivilege	1800	Payload.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4540	STOP STORE SCRIPT - V2 (2).exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4540	STOP STORE SCRIPT - V2 (2).exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4540	STOP STORE SCRIPT - V2 (2).exe
4540	STOP STORE SCRIPT - V2 (2).exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 4836	2096	STOP STORE SCRIPT - V2.exe	89
PID 4836 wrote to memory of 3244	4836	System.exe	90
PID 2096 wrote to memory of 4540	2096	STOP STORE SCRIPT - V2.exe	93
PID 4748 wrote to memory of 3460	4748	System.exe	95
PID 4748 wrote to memory of 1800	4748	System.exe	97
PID 2988 wrote to memory of 6120	2988	System.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\STOP STORE SCRIPT - V2.exe
"C:\Users\Admin\AppData\Local\Temp\STOP STORE SCRIPT - V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\MasonDrop\System.exe
  "C:\Users\Admin\AppData\Local\Temp\MasonDrop\System.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks.exe /create /f /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3244
- C:\Users\Admin\AppData\Local\Temp\MasonDrop\STOP STORE SCRIPT - V2 (2).exe
  "C:\Users\Admin\AppData\Local\Temp\MasonDrop\STOP STORE SCRIPT - V2 (2).exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4540

C:\Users\Admin\AppData\Roaming\System.exe
C:\Users\Admin\AppData\Roaming\System.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3460
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1800

C:\Users\Admin\AppData\Roaming\System.exe
"C:\Users\Admin\AppData\Roaming\System.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "System" /tr "C:\Users\Admin\AppData\Roaming\System.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

STOP STORE SCRIPT - V2 (2).exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\STOP STORE SCRIPT - V2 (2).exe
Size 5.4MB
SHA256 8ff5c5735cc9d9bb81e9d51c1c58405cc56221a517d184041b6fe912890b8f2a
MD5 c5f3eeb30dce67302c82f394bfe15c14
SHA1 ed3ef265f4da1f229e561e6a5dd2ca2c6cdb0e04
SHA512 2a6bb28e0bbc13fdb43cbaa7db395dd48e70e4aabba32408af770b01c7a38a3f430a5bb0f04d371bbf923fe5b51f10714fc5066efbcff5738b4a0bd347c85db1
SSDEEP 98304:9Dnp4Y7vu2IDXeAcWQLYTxCFLQZG0mh14hL1g7:1p4Y70Xq+2yGNhi
TLSH
T1F2463384DAD73BD7C00989790A46B7BC36761EF30594CEAD54943B92E8B3C0675B3B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonDrop\System.exe
Size 58KB
SHA256 b9eb021839a56e08b58bb945f574585385e09cbd3d938a2340b5688ee7dd1dd5
MD5 b3b9a4181f43eb00294d596ce86976e9
SHA1 adf5337c517cc2542d744564d5eace253c5229ba
SHA512 91d9033e4ca486655240ca3f61ac6e57de1b7eadbe83d523d8129f474df1b3a3284690e9759483927dfac04134d9cb153cb9fb8cad360bc43d89eb7ffea5a466
SSDEEP 768:N4SwzNnDCgr4jK/fRGCVMSVanDTw+0Bsu1wRxkSUN+1XQJuvQ1bnD0QxHaJ3BQ/:SzRmgr9nDVoU7KMVNSQkvQ96J6
TLSH
T169431B0BF35364ECC51AC27486EB6773BA71BD6601359F3F4760DA312E11E60AE29B18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Payload.exe

Path C:\Users\Admin\AppData\Local\Temp\Payload.exe
Size 55KB
SHA256 520afe474c0d141f0efb5ab826e581fb4d0e87a30cf6e34fd509af71d3829f26
MD5 0af61a3613cb79aec77d9d2a6e2756e1
SHA1 8b33bf886db31c1065034cbbfbda71d17561290e
SHA512 4295a1c009acc223c315d030c85d1a1d4392fab3c09571f8c15498d7b8aebb0c62a10c16c3d60a21d2b2d0284a566c319396b6335c43321e0ef2538483555410
SSDEEP 1536:dwws4DnAN7jytFADRwsNMDMXExI3pm4m:iT4DnA2PADRwsNMDMXExI3pm
TLSH
T10D432844BFEA4A01E2BD8F3469F555150634BA63E532EB1F48D668EB13327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~msnDEV-0e22b63f91b96891.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-0e22b63f91b96891.tmp
Size 4B
SHA256 29c51857b6c0b5cf945a7baed5e8c15b45e558a6fdccaca10064542f0e38211d
MD5 59cfb70d096872de54397de79fdec822
SHA1 434619f68a3e578565c234f906977654bdc7e040
SHA512 04f04cdea000057d702e7a11c0f5f9dd9174e1a86d563d40b7e3fe71c5ff298bb155d7793938fce73179dbeafc9270866e0c410d9b967307373d2c786f91ba7b
MD5 SHA1 SHA512

Submit Download

~msnDEV-0e22b63f91b96891.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-0e22b63f91b96891.tmp
Size 4B
SHA256 93154bd5adcae2f24b2d1cc5787ad282372c481ab6df518d5d26bd7da10f34eb
MD5 6d97009ef57acbcfc1992cf78aa5d741
SHA1 22de4292b305b3b8151247d284ba0add96e80fc8
SHA512 8b6d86ce126c442f46de0de033628a6e42b41ea84fc9f2f472d82193b8a23e05918dd81159a4283316f5722c4ad4de839caa8ca4dd3a8b0a4d2d7bbb20e029a2
MD5 SHA1 SHA512

Submit Download

memory/2096-27-0x00007FF64BA00000-0x00007FF64BA0D000-memory.dmp

Download

memory/2988-81-0x00007FF7D3360000-0x00007FF7D3379000-memory.dmp

Download

memory/2988-70-0x00000002DBB60000-0x00000002DBBBA000-memory.dmp

Download

memory/4540-46-0x0000000001470000-0x0000000001471000-memory.dmp

Download

memory/4540-47-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/4540-49-0x0000000003560000-0x0000000003561000-memory.dmp

Download

memory/4540-51-0x0000000003580000-0x0000000003581000-memory.dmp

Download

memory/4540-50-0x0000000003570000-0x0000000003571000-memory.dmp

Download

memory/4540-48-0x0000000003550000-0x0000000003551000-memory.dmp

Download

memory/4540-52-0x0000000000400000-0x0000000000D5F000-memory.dmp

Download

memory/4540-45-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/4540-44-0x0000000001340000-0x0000000001341000-memory.dmp

Download

memory/4748-55-0x00007FF7D3360000-0x00007FF7D3379000-memory.dmp

Download

memory/4748-65-0x00007FF7D3360000-0x00007FF7D3379000-memory.dmp

Download

memory/4836-30-0x00007FF6E4FE0000-0x00007FF6E4FF9000-memory.dmp

Download

memory/4836-16-0x00000002DBB60000-0x00000002DBBBA000-memory.dmp

Download