Analysis

  • max time kernel
    1768s
  • max time network
    1588s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22-08-2023 10:15

General

  • Target

    MMLo7.Rat.rar

  • Size

    5.7MB

  • MD5

    4747547f047d47bd37bc0d1b65625694

  • SHA1

    827e3f9ca857ed95ef8185c80e5fa85fdffa28e4

  • SHA256

    091833fb986ac8a78a9a33ae7852d2b02d510348bdcb915d4e2e51a6de27f64a

  • SHA512

    3336de360626d125c4777d626a0790c69faf209c642d99d085cd72f92b9e5ba93aca9f9c92d81cb1e3b2ee21f6ff12cf9c6fe6ecbe9554ad846fa1cd74874241

  • SSDEEP

    98304:HtkSjvhd8cMOBhzp1svAJFF5N7nicdRaDzmLW/nJHksov7iUsPIUDjvEQnQLligi:HtBjJd8vazEQFPN7tAeaBLNUsPIUvMUL

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat.rar
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2156
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:852
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\" -spe -an -ai#7zMap9300:98:7zEvent31267
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2624
    • C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\MMLo7 Rat.exe
      "C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\MMLo7 Rat.exe"
      1⤵
      • Executes dropped EXE
      PID:700

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\MMLo7 Rat.exe

      Filesize

      2.8MB

      MD5

      2dc24c81438806bd03b492b9a3f3c55c

      SHA1

      1b62f6d53570d7cd3c8d04e6ea7e349b5de5cc89

      SHA256

      3edd74d68dd78681ed9eae3973ee2fb878c60e6e24dfa313ea2b4547008b1149

      SHA512

      f03ef03ffd926c35a6c88be065a8b6174af323a9fc633fc8d0c1ee55bf8b2eb5ef824d9c9feda21104dd10ff7f0d8d0660e9d4ba0cd8a932dd5d8e342f023ce1

    • C:\Users\Admin\AppData\Local\Temp\MMLo7.Rat\MMLo7 Rat.exe.config

      Filesize

      161B

      MD5

      c16b0746faa39818049fe38709a82c62

      SHA1

      3fa322fe6ed724b1bc4fd52795428a36b7b8c131

      SHA256

      d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

      SHA512

      cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

    • memory/2156-82-0x000000013F1A0000-0x000000013F298000-memory.dmp

      Filesize

      992KB

    • memory/2156-83-0x000007FEF7B80000-0x000007FEF7BB4000-memory.dmp

      Filesize

      208KB

    • memory/2156-84-0x000007FEF60B0000-0x000007FEF6364000-memory.dmp

      Filesize

      2.7MB

    • memory/2156-85-0x000007FEFBBC0000-0x000007FEFBBD8000-memory.dmp

      Filesize

      96KB

    • memory/2156-86-0x000007FEF7B60000-0x000007FEF7B77000-memory.dmp

      Filesize

      92KB

    • memory/2156-87-0x000007FEF7AD0000-0x000007FEF7AE1000-memory.dmp

      Filesize

      68KB

    • memory/2156-88-0x000007FEF7AB0000-0x000007FEF7AC7000-memory.dmp

      Filesize

      92KB

    • memory/2156-89-0x000007FEF6D80000-0x000007FEF6D91000-memory.dmp

      Filesize

      68KB

    • memory/2156-90-0x000007FEF6D60000-0x000007FEF6D7D000-memory.dmp

      Filesize

      116KB

    • memory/2156-91-0x000007FEF6D40000-0x000007FEF6D51000-memory.dmp

      Filesize

      68KB

    • memory/2156-92-0x000007FEF5EB0000-0x000007FEF60B0000-memory.dmp

      Filesize

      2.0MB

    • memory/2156-93-0x000007FEF6890000-0x000007FEF68CF000-memory.dmp

      Filesize

      252KB

    • memory/2156-94-0x000007FEF4E00000-0x000007FEF5EAB000-memory.dmp

      Filesize

      16.7MB

    • memory/2156-95-0x000007FEF6860000-0x000007FEF6881000-memory.dmp

      Filesize

      132KB

    • memory/2156-96-0x000007FEF67D0000-0x000007FEF67E8000-memory.dmp

      Filesize

      96KB

    • memory/2156-97-0x000007FEF67B0000-0x000007FEF67C1000-memory.dmp

      Filesize

      68KB

    • memory/2156-98-0x000007FEF6790000-0x000007FEF67A1000-memory.dmp

      Filesize

      68KB

    • memory/2156-99-0x000007FEF6770000-0x000007FEF6781000-memory.dmp

      Filesize

      68KB

    • memory/2156-100-0x000007FEF6750000-0x000007FEF676B000-memory.dmp

      Filesize

      108KB

    • memory/2156-102-0x000007FEF6710000-0x000007FEF6728000-memory.dmp

      Filesize

      96KB

    • memory/2156-101-0x000007FEF6730000-0x000007FEF6741000-memory.dmp

      Filesize

      68KB

    • memory/2156-106-0x000007FEF4D70000-0x000007FEF4D81000-memory.dmp

      Filesize

      68KB

    • memory/2156-105-0x000007FEF4D90000-0x000007FEF4DFF000-memory.dmp

      Filesize

      444KB

    • memory/2156-104-0x000007FEFADE0000-0x000007FEFAE47000-memory.dmp

      Filesize

      412KB

    • memory/2156-103-0x000007FEFAE50000-0x000007FEFAE80000-memory.dmp

      Filesize

      192KB

    • memory/2156-107-0x000007FEF4D10000-0x000007FEF4D66000-memory.dmp

      Filesize

      344KB

    • memory/2156-108-0x000007FEF4CE0000-0x000007FEF4D08000-memory.dmp

      Filesize

      160KB

    • memory/2156-112-0x000007FEF4B70000-0x000007FEF4B81000-memory.dmp

      Filesize

      68KB

    • memory/2156-111-0x000007FEF4B90000-0x000007FEF4BB3000-memory.dmp

      Filesize

      140KB

    • memory/2156-110-0x000007FEF4BC0000-0x000007FEF4BD7000-memory.dmp

      Filesize

      92KB

    • memory/2156-109-0x000007FEF4CB0000-0x000007FEF4CD4000-memory.dmp

      Filesize

      144KB

    • memory/2156-113-0x000007FEF4B50000-0x000007FEF4B62000-memory.dmp

      Filesize

      72KB

    • memory/2156-114-0x000007FEF4B20000-0x000007FEF4B41000-memory.dmp

      Filesize

      132KB

    • memory/2156-115-0x000007FEF4A60000-0x000007FEF4A73000-memory.dmp

      Filesize

      76KB

    • memory/2156-116-0x000007FEF4A40000-0x000007FEF4A52000-memory.dmp

      Filesize

      72KB

    • memory/2156-117-0x000007FEF4900000-0x000007FEF4A3B000-memory.dmp

      Filesize

      1.2MB

    • memory/2156-118-0x000007FEF48D0000-0x000007FEF48FC000-memory.dmp

      Filesize

      176KB

    • memory/2156-119-0x000007FEF42A0000-0x000007FEF4452000-memory.dmp

      Filesize

      1.7MB

    • memory/2156-120-0x000007FEF4080000-0x000007FEF40DC000-memory.dmp

      Filesize

      368KB

    • memory/2156-121-0x000007FEF4060000-0x000007FEF4071000-memory.dmp

      Filesize

      68KB

    • memory/2156-122-0x000007FEF3FC0000-0x000007FEF4057000-memory.dmp

      Filesize

      604KB

    • memory/2156-123-0x000007FEF3E00000-0x000007FEF3E12000-memory.dmp

      Filesize

      72KB

    • memory/2156-124-0x000007FEF3870000-0x000007FEF3AA1000-memory.dmp

      Filesize

      2.2MB

    • memory/2156-125-0x000007FEF3710000-0x000007FEF3822000-memory.dmp

      Filesize

      1.1MB

    • memory/2156-126-0x000007FEF36B0000-0x000007FEF36E5000-memory.dmp

      Filesize

      212KB

    • memory/2156-127-0x000007FEF3680000-0x000007FEF36A5000-memory.dmp

      Filesize

      148KB

    • memory/2156-128-0x000007FEF3660000-0x000007FEF3671000-memory.dmp

      Filesize

      68KB

    • memory/2156-131-0x000007FEF35B0000-0x000007FEF35C2000-memory.dmp

      Filesize

      72KB

    • memory/2156-130-0x000007FEF35D0000-0x000007FEF35E1000-memory.dmp

      Filesize

      68KB

    • memory/2156-129-0x000007FEF35F0000-0x000007FEF3651000-memory.dmp

      Filesize

      388KB

    • memory/2156-132-0x000007FEF3590000-0x000007FEF35A3000-memory.dmp

      Filesize

      76KB

    • memory/2156-133-0x000007FEF34F0000-0x000007FEF358F000-memory.dmp

      Filesize

      636KB

    • memory/2156-134-0x000007FEF34D0000-0x000007FEF34E1000-memory.dmp

      Filesize

      68KB

    • memory/2156-135-0x000007FEF33C0000-0x000007FEF34C2000-memory.dmp

      Filesize

      1.0MB

    • memory/2156-136-0x000007FEF33A0000-0x000007FEF33B1000-memory.dmp

      Filesize

      68KB

    • memory/2156-137-0x000007FEF3380000-0x000007FEF3391000-memory.dmp

      Filesize

      68KB

    • memory/2156-138-0x000007FEF3360000-0x000007FEF3371000-memory.dmp

      Filesize

      68KB

    • memory/2156-139-0x000007FEF3340000-0x000007FEF3352000-memory.dmp

      Filesize

      72KB

    • memory/2156-140-0x000007FEF3320000-0x000007FEF3338000-memory.dmp

      Filesize

      96KB

    • memory/2156-141-0x000007FEF3300000-0x000007FEF3316000-memory.dmp

      Filesize

      88KB

    • memory/2156-142-0x000007FEF32D0000-0x000007FEF32F9000-memory.dmp

      Filesize

      164KB

    • memory/2156-143-0x000007FEF32B0000-0x000007FEF32C2000-memory.dmp

      Filesize

      72KB

    • memory/2156-144-0x000007FEF3290000-0x000007FEF32A1000-memory.dmp

      Filesize

      68KB

    • memory/2156-145-0x000007FEF3270000-0x000007FEF3281000-memory.dmp

      Filesize

      68KB