Analysis
- user interaction
yes - max time kernel
102s - max time network
96s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
13/11/2026, 15:36
General
- Target NJRAT-SOVIET-VERSION--999.rar
- Size 2.4MB
- Sample261113-s19ryads7p
- SHA256 113108c95e145053809539d29d06c2f23c8970e25ad28c062da131a4716b4ef3
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies registry class 53 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\NJRAT-SOVIET-VERSION--999.rar"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zO07100D98\NJRAT SOVIET VERSION.EXE"C:\Users\Admin\AppData\Local\Temp\7zO07100D98\NJRAT SOVIET VERSION.EXE"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 14163⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\NJRAT-SOVIET-VERSION--999\NJRAT SOVIET VERSION.EXE"C:\Users\Admin\Desktop\NJRAT-SOVIET-VERSION--999\NJRAT SOVIET VERSION.EXE"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x48c 0x4901⤵
-
C:\Users\Admin\Desktop\Server.exe"C:\Users\Admin\Desktop\Server.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\Desktop\Server.exe" "Server.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\Server.exe"C:\Users\Admin\Desktop\Server.exe" ..1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
NJRAT SOVIET VERSION.EXE
Estub.exe
GeoIP.dat
Mono.Cecil.dll
WinMM.Net.dll
cam.dll
ch.dll
inf.dll
mic.dll
plg.dll
pt.dll
pw.dll
sc2.dll
stub.exe
Server.exe
memory/3212-249-0x00000000299F0000-0x0000000029A42000-memory.dmp
memory/3212-239-0x000000001F340000-0x000000001F352000-memory.dmp
memory/3236-25-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-30-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-35-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-36-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-37-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-38-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-39-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-40-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-41-0x00007FF8BBE45000-0x00007FF8BBE46000-memory.dmp
memory/3236-42-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-43-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-48-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-31-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-32-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-29-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-28-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-26-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-27-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-24-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-23-0x000000001C070000-0x000000001C0BC000-memory.dmp
memory/3236-22-0x0000000000CE0000-0x0000000000CE8000-memory.dmp
memory/3236-21-0x000000001BE10000-0x000000001BEAC000-memory.dmp
memory/3236-20-0x000000001B840000-0x000000001BD0E000-memory.dmp
memory/3236-19-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-17-0x000000001B2C0000-0x000000001B366000-memory.dmp
memory/3236-18-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-16-0x00007FF8BBB90000-0x00007FF8BC531000-memory.dmp
memory/3236-15-0x00007FF8BBE45000-0x00007FF8BBE46000-memory.dmp