ratty | 75465268a123c2219abb78be39d792ddfa3eb6619c3247a321fe298e52b715c9

Analysis

max time kernel
11s
max time network
44s
platform
windows7_x64
resource
win7v20210408
submitted
03-07-2021 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FollowPost.js
Size

2.9MB
MD5

765e5b24dc0aaf8fca72b00f512e41ad
SHA1

2ea472b2eeb1f6676e4d2ce4b7cbb8e0d645b227
SHA256

75465268a123c2219abb78be39d792ddfa3eb6619c3247a321fe298e52b715c9
SHA512

6b515716ce6a1798ca410736d0b22812ce86511ddfa537b7f1e1fd8c8b6f65bb72f0e84fadb9844414dfcd30692e3c7ab44a8b93398e6ae4e1e98e5055bb2485

Score

10^/10

ratty rat trojan

Malware Config

Signatures

Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat Payload 2 IoCs

resource	yara_rule
	family_ratty
behavioral1/files/0x00040000000130df-62.dat	family_ratty

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1104	1636	wscript.exe	29
PID 1636 wrote to memory of 1104	1636	wscript.exe	29
PID 1636 wrote to memory of 1104	1636	wscript.exe	29

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\FollowPost.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\rmbxvgqbd.txt"
  2⤵
  PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1104-61-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Filesize
8KB

Download
memory/1104-63-0x0000000002320000-0x0000000002590000-memory.dmp

Filesize
2.4MB

Download
memory/1104-64-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download