ratty | 9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c

General

Target

ORDER-0021889.jar
Size

415KB
MD5

018e4cd2137de20e2142fd999d9befdf
SHA1

cd37af8a3b23ae0b223ae3e52c3c5b683deb23a0
SHA256

9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c
SHA512

6c0ccf4c049ee705d884539857b1190e89f22567bd726b1c0f31e46ffe7392051860e124e40129fd70b6dd5b6d1c5110d5ec14400b37be00a4c228a565f2b422

Score

10^/10

ratty persistence rat trojan

Malware Config

Signatures

Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat Payload 3 IoCs

resource	yara_rule
	family_ratty
	family_ratty
behavioral2/files/0x0008000000000689-121.dat	family_ratty

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctzwjco.txt	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctzwjco.txt	javaw.exe

Loads dropped DLL 1 IoCs

pid	Process
1688	javaw.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctzwjco.txt = "C:\\Users\\Admin\\AppData\\Roaming\\ctzwjco.txt"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	javaw.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	javaw.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4436	REG.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe
1688	javaw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4392	3524	java.exe	71
PID 3524 wrote to memory of 4392	3524	java.exe	71
PID 4392 wrote to memory of 1688	4392	wscript.exe	72
PID 4392 wrote to memory of 1688	4392	wscript.exe	72
PID 1688 wrote to memory of 4436	1688	javaw.exe	73
PID 1688 wrote to memory of 4436	1688	javaw.exe	73
PID 1688 wrote to memory of 4412	1688	javaw.exe	78
PID 1688 wrote to memory of 4412	1688	javaw.exe	78
PID 1688 wrote to memory of 3192	1688	javaw.exe	77
PID 1688 wrote to memory of 3192	1688	javaw.exe	77

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3192	attrib.exe
4412	attrib.exe

C:\ProgramData\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\ORDER-0021889.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SYSTEM32\wscript.exe
  wscript C:\Users\Admin\lcxjxwgqpx.js
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
    "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\ctzwjco.txt"
    3⤵
    - Drops startup file
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SYSTEM32\REG.exe
      REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "ctzwjco.txt" /d "C:\Users\Admin\AppData\Roaming\ctzwjco.txt" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:4436
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctzwjco.txt
      4⤵
      Views/modifies file attributes
      PID:3192
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +H C:\Users\Admin\AppData\Roaming\ctzwjco.txt
      4⤵
      Views/modifies file attributes
      PID:4412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-131-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1688-132-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1688-137-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1688-123-0x00000000024A0000-0x0000000002710000-memory.dmp

Filesize
2.4MB

Download
memory/1688-135-0x0000000002730000-0x0000000002740000-memory.dmp

Filesize
64KB

Download
memory/1688-136-0x0000000002740000-0x0000000002750000-memory.dmp

Filesize
64KB

Download
memory/1688-133-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/1688-128-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1688-134-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/1688-130-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/3524-115-0x0000000003380000-0x00000000035F0000-memory.dmp

Filesize
2.4MB

Download
memory/3524-116-0x0000000003380000-0x00000000035F0000-memory.dmp

Filesize
2.4MB

Download
memory/3524-118-0x0000000001410000-0x0000000001411000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads