Overview
overview
10Static
static
1Eagle Moni...ck.exe
windows10-2004-x64
10Eagle Moni...er.exe
windows10-2004-x64
1Eagle Moni...or.exe
windows10-2004-x64
1Eagle Moni...2).exe
windows10-2004-x64
1Eagle Moni...4).exe
windows10-2004-x64
1Eagle Moni...er.exe
windows10-2004-x64
1Eagle Moni...or.exe
windows10-2004-x64
1Eagle Moni...gp.ps1
windows10-2004-x64
1Eagle Moni...ls.url
windows10-2004-x64
1Eagle Moni...in.dll
windows10-2004-x64
1Eagle Moni...hy.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...re.dll
windows10-2004-x64
1Eagle Moni...on.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...on.dll
windows10-2004-x64
1Eagle Moni...us.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...ra.dll
windows10-2004-x64
1Eagle Moni...op.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...rp.exe
windows10-2004-x64
1Eagle Moni...pp.dll
windows10-2004-x64
1Eagle Moni...pp.exe
windows10-2004-x64
1Eagle Moni...pp.dll
windows10-2004-x64
1Eagle Moni...nt.exe
windows10-2004-x64
1Eagle Moni...64.exe
windows10-2004-x64
1Eagle Moni...ll.dll
windows10-2004-x64
1Eagle Moni...64.exe
windows10-2004-x64
1Analysis
-
max time kernel
83s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2023 17:29
Static task
static1
Behavioral task
behavioral1
Sample
Eagle Monitor RAT Reborn/Crack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Configurator.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x32).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x64).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Updater.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Tasks Configurator.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
Eagle Monitor RAT Reborn/Flags/FlagsPack1/gp.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Eagle Monitor RAT Reborn/Get all rats & cracked tools.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Eagle Monitor RAT Reborn/Plugins/Admin.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Eagle Monitor RAT Reborn/Plugins/Cryptography.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Eagle Monitor RAT Reborn/Plugins/FileManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Eagle Monitor RAT Reborn/Plugins/Hardware.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
Eagle Monitor RAT Reborn/Plugins/Information.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Eagle Monitor RAT Reborn/Plugins/Keylogger.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
Eagle Monitor RAT Reborn/Plugins/MemoryExecution.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Eagle Monitor RAT Reborn/Plugins/Miscellaneous.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
Eagle Monitor RAT Reborn/Plugins/PowerManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Eagle Monitor RAT Reborn/Plugins/ProcessManager.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral20
Sample
Eagle Monitor RAT Reborn/Plugins/RemoteCamera.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Eagle Monitor RAT Reborn/Plugins/RemoteDesktop.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
Eagle Monitor RAT Reborn/Plugins/ScreenLocker.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Eagle Monitor RAT Reborn/Plugins/Stealer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadCSharp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadDllCpp.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral26
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadExeCpp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x64)/PayloadCpp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
Eagle Monitor RAT Reborn/Stubs/Client.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Eagle Monitor RAT Reborn/Stubs/Client64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
Eagle Monitor RAT Reborn/Stubs/ClientDll.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Eagle Monitor RAT Reborn/Stubs/ClientVB64.exe
Resource
win10v2004-20230220-en
General
-
Target
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadDllCpp.dll
-
Size
8KB
-
MD5
b74cbd7eb9122dfa0813df1b63585021
-
SHA1
03b978583e399599df762c6aa3961e96619528b7
-
SHA256
3664e7be24277252c4025b78e73ca27a20da0a1267f6dccee98d95773172608a
-
SHA512
2b724e5b0467f62e49fd8a1bc63b0d1c1a4377ca5150b237e668b26920bec223a7879a9caea4f22e595d21c6f617cb15c47b1f4198a3ab977608af67067b184d
-
SSDEEP
96:3ScLcXCaiX1tAl58/H2XDZTZsC8+k4s/DjFjOXOQs7xuufQaJozQN:3SWABiX1tA82TZTZdA1jOXXs7A6jJoz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4656 wrote to memory of 2864 4656 rundll32.exe rundll32.exe PID 4656 wrote to memory of 2864 4656 rundll32.exe rundll32.exe PID 4656 wrote to memory of 2864 4656 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Eagle Monitor RAT Reborn\SamplePayloads(x32)\PayloadDllCpp.dll",#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Eagle Monitor RAT Reborn\SamplePayloads(x32)\PayloadDllCpp.dll",#12⤵