Overview
overview
10Static
static
1Eagle Moni...ck.exe
windows10-2004-x64
10Eagle Moni...er.exe
windows10-2004-x64
1Eagle Moni...or.exe
windows10-2004-x64
1Eagle Moni...2).exe
windows10-2004-x64
1Eagle Moni...4).exe
windows10-2004-x64
1Eagle Moni...er.exe
windows10-2004-x64
1Eagle Moni...or.exe
windows10-2004-x64
1Eagle Moni...gp.ps1
windows10-2004-x64
1Eagle Moni...ls.url
windows10-2004-x64
1Eagle Moni...in.dll
windows10-2004-x64
1Eagle Moni...hy.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...re.dll
windows10-2004-x64
1Eagle Moni...on.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...on.dll
windows10-2004-x64
1Eagle Moni...us.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...ra.dll
windows10-2004-x64
1Eagle Moni...op.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...er.dll
windows10-2004-x64
1Eagle Moni...rp.exe
windows10-2004-x64
1Eagle Moni...pp.dll
windows10-2004-x64
1Eagle Moni...pp.exe
windows10-2004-x64
1Eagle Moni...pp.dll
windows10-2004-x64
1Eagle Moni...nt.exe
windows10-2004-x64
1Eagle Moni...64.exe
windows10-2004-x64
1Eagle Moni...ll.dll
windows10-2004-x64
1Eagle Moni...64.exe
windows10-2004-x64
1Analysis
-
max time kernel
126s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2023 17:29
Static task
static1
Behavioral task
behavioral1
Sample
Eagle Monitor RAT Reborn/Crack.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Builder.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Configurator.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x32).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x64).exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Eagle Monitor RAT Reborn/Eagle Monitor RAT Updater.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Eagle Monitor RAT Reborn/Eagle Monitor Tasks Configurator.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral8
Sample
Eagle Monitor RAT Reborn/Flags/FlagsPack1/gp.ps1
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Eagle Monitor RAT Reborn/Get all rats & cracked tools.url
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Eagle Monitor RAT Reborn/Plugins/Admin.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
Eagle Monitor RAT Reborn/Plugins/Cryptography.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Eagle Monitor RAT Reborn/Plugins/FileManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Eagle Monitor RAT Reborn/Plugins/Hardware.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
Eagle Monitor RAT Reborn/Plugins/Information.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Eagle Monitor RAT Reborn/Plugins/Keylogger.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral16
Sample
Eagle Monitor RAT Reborn/Plugins/MemoryExecution.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Eagle Monitor RAT Reborn/Plugins/Miscellaneous.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral18
Sample
Eagle Monitor RAT Reborn/Plugins/PowerManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Eagle Monitor RAT Reborn/Plugins/ProcessManager.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral20
Sample
Eagle Monitor RAT Reborn/Plugins/RemoteCamera.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Eagle Monitor RAT Reborn/Plugins/RemoteDesktop.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral22
Sample
Eagle Monitor RAT Reborn/Plugins/ScreenLocker.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Eagle Monitor RAT Reborn/Plugins/Stealer.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadCSharp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadDllCpp.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral26
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x32)/PayloadExeCpp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Eagle Monitor RAT Reborn/SamplePayloads(x64)/PayloadCpp.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
Eagle Monitor RAT Reborn/Stubs/Client.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Eagle Monitor RAT Reborn/Stubs/Client64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
Eagle Monitor RAT Reborn/Stubs/ClientDll.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
Eagle Monitor RAT Reborn/Stubs/ClientVB64.exe
Resource
win10v2004-20230220-en
General
-
Target
Eagle Monitor RAT Reborn/Eagle Monitor RAT Reborn (x64).exe
-
Size
4.6MB
-
MD5
b34d31d3b257d61f6ffcf5680910e121
-
SHA1
bf0b80b5a59790408f781c93ff18b4fd3cd00522
-
SHA256
0a06210e1d357a31439b3dc2b3a38746eb071a3451111f56608d2ea66bbf03ab
-
SHA512
0c9020a2889ba834becd6e247b875e116421df991bf61a4b3ca4d2d1253562e0cd5e3fa7fde3338e4052592d430a3f98ae08954381b52ab714f53aff0a296ee4
-
SSDEEP
98304:NRguYNMsF0FPCYyvR/kYu6kFEOAElyad:NRgHOsF0FK9vZk36zOAEl
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
Eagle Monitor RAT Reborn (x64).exepid process 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe 3408 Eagle Monitor RAT Reborn (x64).exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Eagle Monitor RAT Reborn (x64).exedescription pid process Token: SeDebugPrivilege 3408 Eagle Monitor RAT Reborn (x64).exe Token: 33 3408 Eagle Monitor RAT Reborn (x64).exe Token: SeIncBasePriorityPrivilege 3408 Eagle Monitor RAT Reborn (x64).exe Token: 33 3408 Eagle Monitor RAT Reborn (x64).exe Token: SeIncBasePriorityPrivilege 3408 Eagle Monitor RAT Reborn (x64).exe Token: 33 3408 Eagle Monitor RAT Reborn (x64).exe Token: SeIncBasePriorityPrivilege 3408 Eagle Monitor RAT Reborn (x64).exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eagle Monitor RAT Reborn\Eagle Monitor RAT Reborn (x64).exe"C:\Users\Admin\AppData\Local\Temp\Eagle Monitor RAT Reborn\Eagle Monitor RAT Reborn (x64).exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3408-133-0x0000020113AB0000-0x0000020113F54000-memory.dmpFilesize
4.6MB
-
memory/3408-134-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-135-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-136-0x0000020134900000-0x0000020134922000-memory.dmpFilesize
136KB
-
memory/3408-137-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-138-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-139-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-140-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-141-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB
-
memory/3408-142-0x0000020115A80000-0x0000020115A90000-memory.dmpFilesize
64KB