Analysis
-
max time kernel
1758s -
max time network
1632s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 18:47
Behavioral task
behavioral1
Sample
Chinese-Rat.rar
Resource
win7-20230831-en
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Chinese-Rat.rar
Resource
win10v2004-20230915-en
7 signatures
1800 seconds
General
-
Target
Chinese-Rat.rar
-
Size
235.1MB
-
MD5
37f249f004fcb1a0c5457fed3defd662
-
SHA1
26befe465eaebcfa026f97dc87f4327857b54d0a
-
SHA256
7f16bbad32fe87a9dbaf60d0958428192dc9b118df58e7d941ade00a56c8951a
-
SHA512
dddab9f58147f56c3247526145529143afc0c2f5e57eacb3bf0e1b63770b527ba963972e01481c4f775bb677a86d16cbcf7f34b7bc6a2fe57c2cf5f9bf66191d
-
SSDEEP
6291456:l5JvhykkRm0yP8SkD0StzoBeO0i+T8Ldu:l5JLd78wStzo50ig8xu
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2672 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2672 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe 2672 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2672 vlc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2740 2364 cmd.exe 29 PID 2364 wrote to memory of 2740 2364 cmd.exe 29 PID 2364 wrote to memory of 2740 2364 cmd.exe 29 PID 2740 wrote to memory of 2672 2740 rundll32.exe 30 PID 2740 wrote to memory of 2672 2740 rundll32.exe 30 PID 2740 wrote to memory of 2672 2740 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Chinese-Rat.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chinese-Rat.rar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Chinese-Rat.rar"3⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1372