runningrat | 4021b25dc6a32dc9157ee22bcf818f9eca8fe0d304ab1b436ea71eefbff92920

General

Target

446.exe
Size

32KB
MD5

1ad4a95949bcea5fc59d635f020e39fc
SHA1

60d6ffd37ce2642ea8699cb0d13e940e4c08619f
SHA256

4021b25dc6a32dc9157ee22bcf818f9eca8fe0d304ab1b436ea71eefbff92920
SHA512

0615fc8007cf43ba3d9ed0d86ccf07ff88f4d89c7dc2d88592f12a8e186c5255029e64376fa84781aad576cedc37c826865c719c6a159e2a7e713c92c204f32f

Score

10^/10

runningrat xmrig miner persistence rat

Malware Config

Signatures

RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 1 IoCs

Processes:

serviecs.exe

pid process

1196 serviecs.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Loads dropped DLL 3 IoCs

Processes:

446.exesvchost.exeserviecs.exe

pid process

3920 446.exe
2560 svchost.exe
1196 serviecs.exe

pid	process
1196	serviecs.exe

pid	process
3920	446.exe
2560	svchost.exe
1196	serviecs.exe

Drops file in System32 directory 3 IoCs

Processes:

svchost.exe446.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\serviecs.exe	svchost.exe
File created	C:\Windows\SysWOW64\259272578.dll	446.exe
File created	C:\Windows\SysWOW64\serviecs.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3464 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

446.exe

pid process

3920 446.exe
3920 446.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

446.exe

description pid process

Token: SeIncBasePriorityPrivilege 3920 446.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

446.exe

pid process

3920 446.exe

pid	process
3464	PING.EXE

pid	process
3920	446.exe
3920	446.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	3920	446.exe

pid	process
3920	446.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

446.execmd.exesvchost.exe

description	pid	process	target process
PID 3920 wrote to memory of 3844	3920	446.exe	cmd.exe
PID 3920 wrote to memory of 3844	3920	446.exe	cmd.exe
PID 3920 wrote to memory of 3844	3920	446.exe	cmd.exe
PID 3844 wrote to memory of 3464	3844	cmd.exe	PING.EXE
PID 3844 wrote to memory of 3464	3844	cmd.exe	PING.EXE
PID 3844 wrote to memory of 3464	3844	cmd.exe	PING.EXE
PID 2560 wrote to memory of 1196	2560	svchost.exe	serviecs.exe
PID 2560 wrote to memory of 1196	2560	svchost.exe	serviecs.exe
PID 2560 wrote to memory of 1196	2560	svchost.exe	serviecs.exe

C:\Users\Admin\AppData\Local\Temp\446.exe
"C:\Users\Admin\AppData\Local\Temp\446.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\446.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
3⤵
- Runs ping.exe
PID:3464

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "serviecs"
1⤵
PID:2440

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "serviecs"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2560

C:\Windows\SysWOW64\serviecs.exe
C:\Windows\system32\serviecs.exe "c:\windows\system32\259272578.dll",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\serviecs.exe
MD5
f57886ace1ab4972b0308f69b1a0029c

SHA1
519b2a981cb522ed2b0901f9871f9aa9781a6cd5

SHA256
2be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852

SHA512
c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8

Download Submit
C:\Windows\SysWOW64\serviecs.exe
MD5
f57886ace1ab4972b0308f69b1a0029c

SHA1
519b2a981cb522ed2b0901f9871f9aa9781a6cd5

SHA256
2be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852

SHA512
c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8

Download Submit
\??\c:\windows\SysWOW64\259272578.dll
MD5
f85e29f1f415f7954841f92966bb3681

SHA1
9f7897fd5e7a04d3af8053fbbf201b06fdca7a78

SHA256
3bbef9eff49dbe41000603cb3eca826697f8e4b94dcf2172d7be690818f755f4

SHA512
caa420d38e8f6553b54e0dd722c2618448f560c38697f4f5d04e88f2632b4e18b8bae92bf2492e63ebbb7cec06547a116536b10b51f74cac67e4c55c8b106fe2

Download Submit
\Windows\SysWOW64\259272578.dll
MD5
f85e29f1f415f7954841f92966bb3681

SHA1
9f7897fd5e7a04d3af8053fbbf201b06fdca7a78

SHA256
3bbef9eff49dbe41000603cb3eca826697f8e4b94dcf2172d7be690818f755f4

SHA512
caa420d38e8f6553b54e0dd722c2618448f560c38697f4f5d04e88f2632b4e18b8bae92bf2492e63ebbb7cec06547a116536b10b51f74cac67e4c55c8b106fe2

Download Submit
\Windows\SysWOW64\259272578.dll
MD5
f85e29f1f415f7954841f92966bb3681

SHA1
9f7897fd5e7a04d3af8053fbbf201b06fdca7a78

SHA256
3bbef9eff49dbe41000603cb3eca826697f8e4b94dcf2172d7be690818f755f4

SHA512
caa420d38e8f6553b54e0dd722c2618448f560c38697f4f5d04e88f2632b4e18b8bae92bf2492e63ebbb7cec06547a116536b10b51f74cac67e4c55c8b106fe2

Download Submit
\Windows\SysWOW64\259272578.dll
MD5
f85e29f1f415f7954841f92966bb3681

SHA1
9f7897fd5e7a04d3af8053fbbf201b06fdca7a78

SHA256
3bbef9eff49dbe41000603cb3eca826697f8e4b94dcf2172d7be690818f755f4

SHA512
caa420d38e8f6553b54e0dd722c2618448f560c38697f4f5d04e88f2632b4e18b8bae92bf2492e63ebbb7cec06547a116536b10b51f74cac67e4c55c8b106fe2

Download Submit
memory/1196-119-0x0000000000000000-mapping.dmp

Download
memory/3464-118-0x0000000000000000-mapping.dmp

Download
memory/3844-117-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing