ratty | 9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c

Analysis

max time kernel
269s
max time network
313s
platform
windows7_x64
resource
win7-en-20210920
submitted
15-10-2021 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER-0021889.jar
Size

415KB
MD5

018e4cd2137de20e2142fd999d9befdf
SHA1

cd37af8a3b23ae0b223ae3e52c3c5b683deb23a0
SHA256

9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c
SHA512

6c0ccf4c049ee705d884539857b1190e89f22567bd726b1c0f31e46ffe7392051860e124e40129fd70b6dd5b6d1c5110d5ec14400b37be00a4c228a565f2b422

Score

10^/10

ratty rat trojan

Malware Config

Signatures

Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat Payload 2 IoCs

resource	yara_rule
	family_ratty
behavioral1/files/0x00070000000125ac-62.dat	family_ratty

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
816	javaw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1704	1884	java.exe	28
PID 1884 wrote to memory of 1704	1884	java.exe	28
PID 1884 wrote to memory of 1704	1884	java.exe	28
PID 1704 wrote to memory of 816	1704	wscript.exe	29
PID 1704 wrote to memory of 816	1704	wscript.exe	29
PID 1704 wrote to memory of 816	1704	wscript.exe	29

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ORDER-0021889.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\wscript.exe
  wscript C:\Users\Admin\lcxjxwgqpx.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files\Java\jre7\bin\javaw.exe
    "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\cumcyrxmak.txt"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-64-0x00000000020E0000-0x0000000002350000-memory.dmp

Filesize
2.4MB

Download
memory/816-65-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1884-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x0000000002300000-0x0000000002570000-memory.dmp

Filesize
2.4MB

Download
memory/1884-56-0x0000000002300000-0x0000000002570000-memory.dmp

Filesize
2.4MB

Download
memory/1884-58-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download