Resubmissions
29-11-2023 18:37
231129-w9nslsbf91 1029-11-2023 18:30
231129-w5nbaabf7s 1029-11-2023 18:23
231129-w1gmyabd85 7Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
29-11-2023 18:30
General
-
Target
888 Rat v1.2.6.exe
-
Size
75.0MB
-
MD5
ad33064a9ca95c5b3ed45c14b7fe2739
-
SHA1
0bd1286fa5fd936a31a4514798daffa444ce8e12
-
SHA256
5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98
-
SHA512
acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647
-
SSDEEP
1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\skin.dllFilesize
239KB
MD529e1d5770184bf45139084bced50d306
SHA176c953cd86b013c3113f8495b656bd721be55e76
SHA256794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307
SHA5127cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8
-
\Users\Admin\AppData\Local\Temp\skin.888ww.msstylesFilesize
3.3MB
MD5ea5d5266b8a7bcc8788c83ebb7c8c7d5
SHA13e9ac1ab7d5d54db9b3d141e82916513e572b415
SHA25691ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1
SHA512404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60
-
\Users\Admin\AppData\Local\Temp\skin.dllFilesize
239KB
MD529e1d5770184bf45139084bced50d306
SHA176c953cd86b013c3113f8495b656bd721be55e76
SHA256794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307
SHA5127cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8
-
memory/2344-41-0x000000000C7F0000-0x000000000C8AB000-memory.dmpFilesize
748KB
-
memory/2344-45-0x00000000008B0000-0x00000000053AD000-memory.dmpFilesize
75.0MB
-
memory/2344-46-0x00000000749E0000-0x0000000074A12000-memory.dmpFilesize
200KB
-
memory/2344-47-0x00000000767B0000-0x000000007684D000-memory.dmpFilesize
628KB
-
memory/2344-48-0x0000000075080000-0x0000000075120000-memory.dmpFilesize
640KB
-
memory/2344-49-0x0000000074DA0000-0x0000000074DF7000-memory.dmpFilesize
348KB
-
memory/2344-50-0x0000000076900000-0x0000000076B15000-memory.dmpFilesize
2.1MB
-
memory/2344-52-0x000000000C7F0000-0x000000000C8AB000-memory.dmpFilesize
748KB
-
memory/2344-51-0x0000000075130000-0x0000000075D7A000-memory.dmpFilesize
12.3MB
-
memory/2344-53-0x0000000076CE0000-0x0000000076E3C000-memory.dmpFilesize
1.4MB
-
memory/2344-54-0x00000000762D0000-0x000000007635F000-memory.dmpFilesize
572KB
-
memory/2344-55-0x0000000076C20000-0x0000000076C4A000-memory.dmpFilesize
168KB
-
memory/2344-56-0x00000000746D0000-0x0000000074721000-memory.dmpFilesize
324KB
-
memory/2344-59-0x00000000749E0000-0x0000000074A12000-memory.dmpFilesize
200KB
-
memory/2344-60-0x0000000075080000-0x0000000075120000-memory.dmpFilesize
640KB
-
memory/2344-58-0x0000000074AF0000-0x0000000074AF9000-memory.dmpFilesize
36KB
-
memory/2344-57-0x00000000008B0000-0x00000000053AD000-memory.dmpFilesize
75.0MB
-
memory/2344-62-0x0000000074DA0000-0x0000000074DF7000-memory.dmpFilesize
348KB
-
memory/2344-61-0x0000000074840000-0x00000000749DE000-memory.dmpFilesize
1.6MB
-
memory/2344-63-0x0000000076900000-0x0000000076B15000-memory.dmpFilesize
2.1MB
-
memory/2344-65-0x0000000076250000-0x00000000762CB000-memory.dmpFilesize
492KB
-
memory/2344-66-0x0000000075130000-0x0000000075D7A000-memory.dmpFilesize
12.3MB
-
memory/2344-67-0x0000000076CE0000-0x0000000076E3C000-memory.dmpFilesize
1.4MB
-
memory/2344-68-0x00000000762D0000-0x000000007635F000-memory.dmpFilesize
572KB
-
memory/2344-71-0x00000000746D0000-0x0000000074721000-memory.dmpFilesize
324KB
-
memory/2344-70-0x0000000074FB0000-0x000000007507C000-memory.dmpFilesize
816KB
-
memory/2344-72-0x00000000749E0000-0x0000000074A12000-memory.dmpFilesize
200KB
-
memory/2344-73-0x00000000767B0000-0x000000007684D000-memory.dmpFilesize
628KB
-
memory/2344-76-0x0000000074DA0000-0x0000000074DF7000-memory.dmpFilesize
348KB
-
memory/2344-75-0x0000000074840000-0x00000000749DE000-memory.dmpFilesize
1.6MB
-
memory/2344-74-0x0000000075080000-0x0000000075120000-memory.dmpFilesize
640KB
-
memory/2344-82-0x0000000074FB0000-0x000000007507C000-memory.dmpFilesize
816KB
-
memory/2344-81-0x00000000762D0000-0x000000007635F000-memory.dmpFilesize
572KB
-
memory/2344-80-0x0000000076250000-0x00000000762CB000-memory.dmpFilesize
492KB
-
memory/2344-77-0x0000000074AD0000-0x0000000074AE2000-memory.dmpFilesize
72KB
-
memory/2344-78-0x0000000076900000-0x0000000076B15000-memory.dmpFilesize
2.1MB
-
memory/2344-83-0x0000000074730000-0x0000000074743000-memory.dmpFilesize
76KB
-
memory/2344-84-0x00000000746D0000-0x0000000074721000-memory.dmpFilesize
324KB
-
memory/2344-85-0x00000000008B0000-0x00000000053AD000-memory.dmpFilesize
75.0MB
-
memory/2344-86-0x0000000074AF0000-0x0000000074AF9000-memory.dmpFilesize
36KB
-
memory/2344-87-0x00000000749E0000-0x0000000074A12000-memory.dmpFilesize
200KB
-
memory/2344-89-0x0000000074840000-0x00000000749DE000-memory.dmpFilesize
1.6MB
-
memory/2344-90-0x0000000074DA0000-0x0000000074DF7000-memory.dmpFilesize
348KB
-
memory/2344-88-0x0000000075080000-0x0000000075120000-memory.dmpFilesize
640KB
-
memory/2344-91-0x0000000074AD0000-0x0000000074AE2000-memory.dmpFilesize
72KB
-
memory/2344-92-0x0000000076900000-0x0000000076B15000-memory.dmpFilesize
2.1MB
-
memory/2344-94-0x0000000074FB0000-0x000000007507C000-memory.dmpFilesize
816KB
-
memory/2344-95-0x00000000746D0000-0x0000000074721000-memory.dmpFilesize
324KB
-
memory/2344-96-0x00000000008B0000-0x00000000053AD000-memory.dmpFilesize
75.0MB
-
memory/2344-98-0x00000000749E0000-0x0000000074A12000-memory.dmpFilesize
200KB
-
memory/2344-97-0x0000000074AF0000-0x0000000074AF9000-memory.dmpFilesize
36KB
-
memory/2344-101-0x0000000074840000-0x00000000749DE000-memory.dmpFilesize
1.6MB
-
memory/2344-99-0x00000000767B0000-0x000000007684D000-memory.dmpFilesize
628KB
-
memory/2344-100-0x0000000075080000-0x0000000075120000-memory.dmpFilesize
640KB
-
memory/2344-103-0x0000000074AD0000-0x0000000074AE2000-memory.dmpFilesize
72KB
-
memory/2344-102-0x0000000074DA0000-0x0000000074DF7000-memory.dmpFilesize
348KB
-
memory/2344-107-0x00000000762D0000-0x000000007635F000-memory.dmpFilesize
572KB
-
memory/2344-106-0x0000000076250000-0x00000000762CB000-memory.dmpFilesize
492KB
-
memory/2344-104-0x0000000076900000-0x0000000076B15000-memory.dmpFilesize
2.1MB
-
memory/2344-112-0x0000000074DA0000-0x0000000074DF7000-memory.dmpFilesize
348KB
-
memory/2344-111-0x00000000746D0000-0x0000000074721000-memory.dmpFilesize
324KB
-
memory/2344-110-0x0000000074730000-0x0000000074743000-memory.dmpFilesize
76KB
-
memory/2344-109-0x0000000074FB0000-0x000000007507C000-memory.dmpFilesize
816KB
-
memory/2344-113-0x00000000008B0000-0x00000000053AD000-memory.dmpFilesize
75.0MB
-
memory/2344-114-0x00000000749E0000-0x0000000074A12000-memory.dmpFilesize
200KB
-
memory/2344-119-0x000000000C7F0000-0x000000000C8AB000-memory.dmpFilesize
748KB