Analysis
- max time kernel
149s - max time network
89s - platform
windows11-21h2_x64 - resource
win11-20240214-en - resource tags
- submitted
09/03/2024, 04:01
General
- Target test1.exe
- Size 356KB
- Sample240309-elpassdc7t
- SHA256 7fa0339b7261d5739da834f8fceec100b0f1db1e622dfc94be912bd72bbf1df9
Malware Config
Signatures
- EagleRat
An open source modular remote access trojan written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 29 IoCs
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 58 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 61 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7803⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4403⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7803⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7883⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7843⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4403⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\test1.exe"C:\Users\Admin\AppData\Local\Temp\test1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SearchHoverUnifiedTileModelCache.dat
SearchHoverUnifiedTileModelCache.dat
memory/432-146-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/432-153-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/468-166-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/468-173-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/820-25-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/820-15-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/820-27-0x0000000001980000-0x0000000001990000-memory.dmp
memory/820-2-0x0000000001980000-0x0000000001990000-memory.dmp
memory/820-1-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/820-0-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/928-134-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/928-129-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/928-126-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1200-48-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1200-56-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1200-49-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1264-155-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1264-156-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1264-159-0x0000000001690000-0x00000000016A0000-memory.dmp
memory/1264-164-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1596-58-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1596-59-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1596-66-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1752-205-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1752-197-0x0000000001520000-0x0000000001530000-memory.dmp
memory/1752-198-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/1752-196-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2088-28-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2088-35-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2356-86-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2356-83-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2356-80-0x0000000001730000-0x0000000001740000-memory.dmp
memory/2356-77-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2924-137-0x0000000000EE0000-0x0000000000EF0000-memory.dmp
memory/2924-136-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/2924-144-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3220-89-0x00000000010C0000-0x00000000010D0000-memory.dmp
memory/3220-88-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3292-24-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3292-16-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3292-17-0x0000000001420000-0x0000000001430000-memory.dmp
memory/3336-4-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3336-5-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3336-6-0x0000000001920000-0x0000000001930000-memory.dmp
memory/3336-13-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3376-75-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3376-68-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3392-46-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3392-38-0x0000000001540000-0x0000000001550000-memory.dmp
memory/3392-37-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3392-39-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3464-175-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3464-176-0x00000000017B0000-0x00000000017C0000-memory.dmp
memory/3464-179-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3464-184-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3536-189-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3536-186-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/3536-194-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/4120-106-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/4120-97-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/4120-98-0x0000000001410000-0x0000000001420000-memory.dmp
memory/4120-101-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/4960-207-0x0000000075020000-0x00000000755D1000-memory.dmp
memory/4960-208-0x00000000010A0000-0x00000000010B0000-memory.dmp
memory/4960-215-0x0000000075020000-0x00000000755D1000-memory.dmp