Analysis

  • max time kernel
    47s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20-08-2022 20:28

General

  • Target

    1.exe

  • Size

    68KB

  • MD5

    93dff428b7ecfc0e4320d5190bd095b4

  • SHA1

    2c8b2fbc863bdbbbe9ec69ec4ca0cefa5afef503

  • SHA256

    76d00037ad0e19a299b97f7781affae6c33254887d0068dd7d13a34cc3d26297

  • SHA512

    a77712c3f40a0ab0ef7bfd8927f5815d1c2d506cd5013fe44a392b1f585e889001ce48e424415c4fbd0598877fd9def3a26e1d24f27731e070d34dffb1b6ba58

Malware Config

Signatures

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

  • RunningRat payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops file in System32 directory 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1916
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "SRDSLS"
    1⤵
      PID:696
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "SRDSLS"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\SysWOW64\SRDSLS.exe
        C:\Windows\system32\SRDSLS.exe "c:\windows\system32\7088170.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        PID:964

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\SRDSLS.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Windows\SysWOW64\SRDSLS.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • C:\Windows\SysWOW64\ini.ini

      Filesize

      44B

      MD5

      688a0af27b9161aedaf4d2a6e7836ccd

      SHA1

      bf5b413bfb1244446a011174c9d15f2ba6b2f4ba

      SHA256

      11a949b684cd68137a8ec9378dd3f82c3a6bc7c1a91bd8ac865ef58beea84540

      SHA512

      262dce9ebcf79d9c7a637185aa3383a811e55bd77e9e29c79967ae5ef8bb2337895e5e02d60f353797f91cbf45fb4628a82990ee36c47077c807737f8f235ec7

    • \??\c:\windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\7088170.dll

      Filesize

      37KB

      MD5

      06dc6402f153aaa067f95cce93e23cd6

      SHA1

      dd74618956182878e33110d2f0900e442c5875a4

      SHA256

      9ef9d33de25bd7eb1692612909c4bb83e754b3824b6088469d6e082e5c8b368c

      SHA512

      401aaa6fd7e57927d87223124b5e0bf69d4a4c9d48c2f349082da65481cabec9f0b89f4a05d39d3fe9b4a6ed1ba040e3f905583b0f181ed2107e2f8edc7c8f16

    • \Windows\SysWOW64\SRDSLS.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/964-65-0x0000000000000000-mapping.dmp

    • memory/1916-54-0x0000000010000000-0x000000001000F000-memory.dmp

      Filesize

      60KB

    • memory/1916-60-0x00000000001E0000-0x00000000001ED000-memory.dmp

      Filesize

      52KB

    • memory/1916-58-0x00000000759E1000-0x00000000759E3000-memory.dmp

      Filesize

      8KB