Overview

overview

10

Static

static

10

d6e428677d...de.exe

windows7_x64

10

d6e428677d...de.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6e428677d03e98845a2c84cb1e04ade.exe

  • Size

    100KB

  • Sample

    201225-mytsvdfp8x

  • MD5

    d6e428677d03e98845a2c84cb1e04ade

  • SHA1

    919abeb108f85e10cece90c349cea08043e307ca

  • SHA256

    435a836a250603d3014f794b7123a5ed21d5481a4a86c10d669e8b1f71e9f113

  • SHA512

    e0ebac44fd156eefd2861c908346baa900b45ee74c17bd11fc5ab903270d6817d5ffd87816c7ef510b70a3a964489108e33921d5409ab858d892abefff994e5c

Score
10/10
runningratpersistencerat

Malware Config

Targets

    • Target

      d6e428677d03e98845a2c84cb1e04ade.exe

    • Size

      100KB

    • MD5

      d6e428677d03e98845a2c84cb1e04ade

    • SHA1

      919abeb108f85e10cece90c349cea08043e307ca

    • SHA256

      435a836a250603d3014f794b7123a5ed21d5481a4a86c10d669e8b1f71e9f113

    • SHA512

      e0ebac44fd156eefd2861c908346baa900b45ee74c17bd11fc5ab903270d6817d5ffd87816c7ef510b70a3a964489108e33921d5409ab858d892abefff994e5c

    Score
    10/10
    runningratpersistencerat

    • RunningRat

      RunningRat is a remote access trojan first seen in 2018.

      ratrunningrat

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks