Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
25/09/2026, 13:32
General
- Target njRAT 0.7d Horror Edition/Plugin/Clip.exe
- Size 13KB
- Sample260925-qsyctstsa1
- SHA256 88b7a47f63f149d273015f4f6ce9ef8c5a731b6cf19db7a95220298603000b8c
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition\Plugin\Clip.exe"C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition\Plugin\Clip.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\njRAT 0.7d Horror Edition\Plugin\Clip.exe2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4784-0-0x00007FFC49725000-0x00007FFC49726000-memory.dmp
memory/4784-1-0x000000001BC30000-0x000000001BCD6000-memory.dmp
memory/4784-2-0x000000001C240000-0x000000001C70E000-memory.dmp
memory/4784-4-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-3-0x000000001C7B0000-0x000000001C84C000-memory.dmp
memory/4784-5-0x0000000001610000-0x0000000001618000-memory.dmp
memory/4784-6-0x000000001C9E0000-0x000000001CA2C000-memory.dmp
memory/4784-7-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-8-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-9-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-10-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-12-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-14-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp
memory/4784-15-0x00007FFC49470000-0x00007FFC49E11000-memory.dmp