Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    801KB

  • Sample

    230723-yejxaagg5z

  • MD5

    49745133606dd24fec10eb0540784bfe

  • SHA1

    559feb5253e13b3779cb4f7ce7c14346144dc7aa

  • SHA256

    71f9d2b521480150670747508c2751628c5cf1a485ddf6ecca78f67f8cb9e333

  • SHA512

    379c850ef82f45a5afb616afeda8c44b63111025f0321377ac593c0a49167d8e5ddecc7f81e3b0474e4e9921ae6be51af474cafd833c275677f1cefca7339770

  • SSDEEP

    12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9zl6MM2j:GnsJ39LyjbJkQFMhmC+6GD995

Score
10/10
runningratpersistencerat

Malware Config

Targets

    • Target

      tmp

    • Size

      801KB

    • MD5

      49745133606dd24fec10eb0540784bfe

    • SHA1

      559feb5253e13b3779cb4f7ce7c14346144dc7aa

    • SHA256

      71f9d2b521480150670747508c2751628c5cf1a485ddf6ecca78f67f8cb9e333

    • SHA512

      379c850ef82f45a5afb616afeda8c44b63111025f0321377ac593c0a49167d8e5ddecc7f81e3b0474e4e9921ae6be51af474cafd833c275677f1cefca7339770

    • SSDEEP

      12288:GMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9zl6MM2j:GnsJ39LyjbJkQFMhmC+6GD995

    Score
    10/10
    runningratpersistencerat

    • RunningRat

      RunningRat is a remote access trojan first seen in 2018.

      ratrunningrat

    • RunningRat payload

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Creates a Windows Service

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks