ratty | cd8b8bd578f20672dee0a5189d4869055784e9f23d4fcda28ceeaa25079be3a6

General

Target

tracking_details2.jar
Size

332KB
MD5

8fa5ec1d2c2e4af02168b9f544523f49
SHA1

bc65f27ca5c3b665e800dc07626bcd66604af7cb
SHA256

cd8b8bd578f20672dee0a5189d4869055784e9f23d4fcda28ceeaa25079be3a6
SHA512

89bffc7fdacf9821a2245b0985dda349c5ecea63563263a2050a40b33cf29d4b33d765595d91b7b66075bb3481e1ab15e114f7ccfae55eb512e16b96c295e664

Score

10^/10

Ratty Rat Payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001ab5e-4.dat	family_ratty

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tracking_details2.jar	java.exe

Loads dropped DLL 1 IoCs

pid	Process
3940	java.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\tracking_details2.jar = "C:\\Users\\Admin\\AppData\\Roaming\\tracking_details2.jar"	REG.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	java.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	java.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
3708	REG.exe

Suspicious use of SetWindowsHookEx 40 IoCs

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3708	3940	java.exe	76
PID 3940 wrote to memory of 3708	3940	java.exe	76
PID 3940 wrote to memory of 3824	3940	java.exe	78
PID 3940 wrote to memory of 3824	3940	java.exe	78
PID 3940 wrote to memory of 3228	3940	java.exe	79
PID 3940 wrote to memory of 3228	3940	java.exe	79

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

pid	Process
3824	attrib.exe
3228	attrib.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\tracking_details2.jar
1⤵
- Drops startup file
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\SYSTEM32\REG.exe
  REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "tracking_details2.jar" /d "C:\Users\Admin\AppData\Roaming\tracking_details2.jar" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3708
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\tracking_details2.jar
  2⤵
  - Views/modifies file attributes
  PID:3824
- C:\Windows\SYSTEM32\attrib.exe
  attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tracking_details2.jar
  2⤵
  - Views/modifies file attributes
  PID:3228