ratty | 9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c

Analysis

Target

ORDER-0021889.jar
Size

415KB
MD5

018e4cd2137de20e2142fd999d9befdf
SHA1

cd37af8a3b23ae0b223ae3e52c3c5b683deb23a0
SHA256

9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c
SHA512

6c0ccf4c049ee705d884539857b1190e89f22567bd726b1c0f31e46ffe7392051860e124e40129fd70b6dd5b6d1c5110d5ec14400b37be00a4c228a565f2b422

Score

10^/10

ratty rat trojan

Ratty Rat Payload 2 IoCs

Processes:

resource	yara_rule
	family_ratty
behavioral1/files/0x00070000000125ac-62.dat	family_ratty

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

javaw.exe

pid	Process
816	javaw.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

java.exewscript.exe

description	pid	Process	procid_target
PID 1884 wrote to memory of 1704	1884	java.exe	28
PID 1884 wrote to memory of 1704	1884	java.exe	28
PID 1884 wrote to memory of 1704	1884	java.exe	28
PID 1704 wrote to memory of 816	1704	wscript.exe	29
PID 1704 wrote to memory of 816	1704	wscript.exe	29
PID 1704 wrote to memory of 816	1704	wscript.exe	29

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ORDER-0021889.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\wscript.exe
  wscript C:\Users\Admin\lcxjxwgqpx.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files\Java\jre7\bin\javaw.exe
    "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\cumcyrxmak.txt"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    PID:816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\cumcyrxmak.txt

MD5
af7f264ed40f293a01ee685ee7d42daf

SHA1
a20caef9550c2ae144529b60598b5f58e63a409a

SHA256
2436fa28a278522c298b3a398ddc553c96c4be29ae7b433a999ad49ac71d656c

SHA512
05a060fe3d4b9f92180987d742e5ecad0deb1c5d2cbb1deec0fb31af8ddc5aa867b73ac0b9af02a764c453ba50fc4e9bd6d42b83b294a9e9bcf91b32c34ded7d

Download Submit
C:\Users\Admin\lcxjxwgqpx.js

MD5
65225b9f3a8c18d88929b65409c24f6b

SHA1
0e67e77a99ce04077739672198a0b29f43790dfb

SHA256
2b668f355b8bacb7aebb291c83808a557700807d441564f78784debd86e3e2cc

SHA512
6ba01958b389e8a618732992a6f1f37f19ace63284278d9c7966a1668301d7ad4e48385d19a76db9907b4e7484ba960510041ab2a1a21f9fca9b2e5e5f86a6fd

Download Submit
memory/816-60-0x0000000000000000-mapping.dmp

Download
memory/816-64-0x00000000020E0000-0x0000000002350000-memory.dmp

Filesize
2.4MB

Download
memory/816-65-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/1704-57-0x0000000000000000-mapping.dmp

Download
memory/1884-54-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

Filesize
8KB

Download
memory/1884-55-0x0000000002300000-0x0000000002570000-memory.dmp

Filesize
2.4MB

Download
memory/1884-56-0x0000000002300000-0x0000000002570000-memory.dmp

Filesize
2.4MB

Download
memory/1884-58-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download