Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 22:25
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target Payload.exe
- Size 55KB
- Sample260919-2b57wsty8p
- SHA256 54b8a25105074a8519916482132d356f3aa5f6850fd4465c35191242a682dd61
- MD5 c38dcce81fa179130d6b88ce58b80993
- SHA1 dbfc8db05471b9961fe83c6ec229eba27d270510
- SHA512 11c1673034210fc71646ae5c31758434a2b053be76f2e494bcc99d4909946ab7a967e90738e1b0dbbbf66de8b8b9c544148fe6c2b064535b0347b53d136fe6f3
- SSDEEP 1536:AfZMDnE4uNhty4X+SChDVwsNMDYXExI3pmdm:4MDnlIk4XohDVwsNMDYXExI3pm
- TLSH T17A432844BFEA4A01E2BD8F3468F655150634BA63E532EB1F88D668DB17327C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
njrat
Version
-
<- NjRAT 0.7d Horror Edition ->
Botnet
-
Victim
C2
-
22.tcp.cpolar.top:12854
Mutex
-
4c9e43802808b800042a47248ebe14d8
Attributes
-
reg_key
4c9e43802808b800042a47248ebe14d8
-
splitter
Y262SUCZ4UJJ
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4244 dllhost.exe 2176 dllhost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\4c9e43802808b800042a47248ebe14d8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4c9e43802808b800042a47248ebe14d8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost.exe\" .." dllhost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe 2376 Payload.exe - Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2376 Payload.exe Token: SeDebugPrivilege 4244 dllhost.exe Token: SeDebugPrivilege 2176 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe Token: 33 4244 dllhost.exe Token: SeIncBasePriorityPrivilege 4244 dllhost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2376 wrote to memory of 4244 2376 Payload.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Users\Admin\AppData\Local\Temp\dllhost.exe"C:\Users\Admin\AppData\Local\Temp\dllhost.exe" ..1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2176
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\dllhost.exe
- Size 55KB
- SHA256 54b8a25105074a8519916482132d356f3aa5f6850fd4465c35191242a682dd61
- MD5 c38dcce81fa179130d6b88ce58b80993
- SHA1 dbfc8db05471b9961fe83c6ec229eba27d270510
- SHA512 11c1673034210fc71646ae5c31758434a2b053be76f2e494bcc99d4909946ab7a967e90738e1b0dbbbf66de8b8b9c544148fe6c2b064535b0347b53d136fe6f3
- SSDEEP 1536:AfZMDnE4uNhty4X+SChDVwsNMDYXExI3pmdm:4MDnlIk4XohDVwsNMDYXExI3pm
- TLSH T17A432844BFEA4A01E2BD8F3468F655150634BA63E532EB1F88D668DB17327C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH