Overview
overview
10Static
static
1Eagle Moni...ck.exe
windows10-2004-x64
10Eagle Moni...er.exe
windows10-2004-x64
1Eagle Moni...or.exe
windows10-2004-x64
1Eagle Moni...2).exe
windows10-2004-x64
1Eagle Moni...4).exe
windows10-2004-x64
1Eagle Moni...er.exe
windows10-2004-x64
1Eagle Moni...or.exe
windows10-2004-x64
1Eagle Moni...gp.ps1
windows10-2004-x64
1Eagle Moni...ls.url
windows10-2004-x64
1Eagle Moni...in.dll
windows10-2004-x64
1Eagle Moni...hy.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...re.dll
windows10-2004-x64
1Eagle Moni...on.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...on.dll
windows10-2004-x64
1Eagle Moni...us.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...ra.dll
windows10-2004-x64
1Eagle Moni...op.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...rp.exe
windows10-2004-x64
1Eagle Moni...pp.dll
windows10-2004-x64
1Eagle Moni...pp.exe
windows10-2004-x64
1Eagle Moni...pp.dll
windows10-2004-x64
1Eagle Moni...nt.exe
windows10-2004-x64
1Eagle Moni...64.exe
windows10-2004-x64
1Eagle Moni...ll.dll
windows10-2004-x64
1Eagle Moni...64.exe
windows10-2004-x64
1Analysis
-
max time kernel
123s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2023 17:29
Static task
static1
Behavioral task
behavioral1
Sample
Eagle Monitor RAT Reborn/Crack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Configurator.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x32).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x64).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Updater.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Tasks Configurator.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
Eagle Monitor RAT Reborn/Flags/FlagsPack1/gp.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Eagle Monitor RAT Reborn/Get all rats & cracked tools.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Eagle Monitor RAT Reborn/Plugins/Admin.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Eagle Monitor RAT Reborn/Plugins/Cryptography.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Eagle Monitor RAT Reborn/Plugins/FileManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Eagle Monitor RAT Reborn/Plugins/Hardware.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
Eagle Monitor RAT Reborn/Plugins/Information.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Eagle Monitor RAT Reborn/Plugins/Keylogger.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
Eagle Monitor RAT Reborn/Plugins/MemoryExecution.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Eagle Monitor RAT Reborn/Plugins/Miscellaneous.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
Eagle Monitor RAT Reborn/Plugins/PowerManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Eagle Monitor RAT Reborn/Plugins/ProcessManager.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral20
Sample
Eagle Monitor RAT Reborn/Plugins/RemoteCamera.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Eagle Monitor RAT Reborn/Plugins/RemoteDesktop.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
Eagle Monitor RAT Reborn/Plugins/ScreenLocker.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Eagle Monitor RAT Reborn/Plugins/Stealer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadCSharp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadDllCpp.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral26
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadExeCpp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x64)/PayloadCpp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
Eagle Monitor RAT Reborn/Stubs/Client.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Eagle Monitor RAT Reborn/Stubs/Client64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
Eagle Monitor RAT Reborn/Stubs/ClientDll.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Eagle Monitor RAT Reborn/Stubs/ClientVB64.exe
Resource
win10v2004-20230220-en
General
-
Target
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x32).exe
-
Size
4.6MB
-
MD5
d198c696d700df56e04317a1f5169920
-
SHA1
89ceb4b7b35f2c74f3b9acd1db9d5e6411fe3346
-
SHA256
a3de5d8587704bc3073e147389fd4c426f99c9cafef0c0b71fab1569a2e892e9
-
SHA512
118ff90488bd8489b890438c5552fff26c036182529061032e0f463def453b9e1cc0c5b37ec770166020391d06ea4ee891b83ad9352d698f05feb917d1517294
-
SSDEEP
98304:TRg+YNMTFbFPCYyvR/kYu6kFEOAElyaK:TRgXOTFbFK9vZk36zOAEl
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Eagle Monitor RAT Reborn (x32).exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Eagle Monitor RAT Reborn (x32).exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Eagle Monitor RAT Reborn (x32).exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
Eagle Monitor RAT Reborn (x32).exepid process 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe 1308 Eagle Monitor RAT Reborn (x32).exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Eagle Monitor RAT Reborn (x32).exedescription pid process Token: SeDebugPrivilege 1308 Eagle Monitor RAT Reborn (x32).exe Token: 33 1308 Eagle Monitor RAT Reborn (x32).exe Token: SeIncBasePriorityPrivilege 1308 Eagle Monitor RAT Reborn (x32).exe Token: 33 1308 Eagle Monitor RAT Reborn (x32).exe Token: SeIncBasePriorityPrivilege 1308 Eagle Monitor RAT Reborn (x32).exe Token: 33 1308 Eagle Monitor RAT Reborn (x32).exe Token: SeIncBasePriorityPrivilege 1308 Eagle Monitor RAT Reborn (x32).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eagle Monitor RAT Reborn\Eagle Monitor RAT Reborn (x32).exe"C:\Users\Admin\AppData\Local\Temp\Eagle Monitor RAT Reborn\Eagle Monitor RAT Reborn (x32).exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-133-0x0000000000EF0000-0x0000000001396000-memory.dmpFilesize
4.6MB
-
memory/1308-134-0x0000000006420000-0x00000000069C4000-memory.dmpFilesize
5.6MB
-
memory/1308-135-0x0000000005DB0000-0x0000000005E42000-memory.dmpFilesize
584KB
-
memory/1308-136-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/1308-137-0x00000000062B0000-0x00000000062BA000-memory.dmpFilesize
40KB
-
memory/1308-138-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/1308-139-0x000000000B450000-0x000000000B472000-memory.dmpFilesize
136KB
-
memory/1308-140-0x000000000D650000-0x000000000D6EC000-memory.dmpFilesize
624KB
-
memory/1308-141-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB
-
memory/1308-142-0x0000000005E60000-0x0000000005E70000-memory.dmpFilesize
64KB