ratty | 9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

018e4cd2137de20e2142fd999d9befdf_JaffaCakes118.jar
Size

415KB
MD5

018e4cd2137de20e2142fd999d9befdf
SHA1

cd37af8a3b23ae0b223ae3e52c3c5b683deb23a0
SHA256

9832570f59982ffca53c953d3d58c95e1224ffe236fa401d3e8a2cdfe71b717c
SHA512

6c0ccf4c049ee705d884539857b1190e89f22567bd726b1c0f31e46ffe7392051860e124e40129fd70b6dd5b6d1c5110d5ec14400b37be00a4c228a565f2b422
SSDEEP

12288:TFAzU67etJXECDCXUxqyNq4D8HkxU5YCyNU:TFG77etR7CXUxfNqQxUINU

Score

10^/10

ratty rat trojan

Malware Config

Signatures

Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\adytbydbr.txt	family_ratty

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

java.exewscript.exe

description	pid	process	target process
PID 2140 wrote to memory of 2360	2140	java.exe	wscript.exe
PID 2140 wrote to memory of 2360	2140	java.exe	wscript.exe
PID 2140 wrote to memory of 2360	2140	java.exe	wscript.exe
PID 2360 wrote to memory of 2656	2360	wscript.exe	javaw.exe
PID 2360 wrote to memory of 2656	2360	wscript.exe	javaw.exe
PID 2360 wrote to memory of 2656	2360	wscript.exe	javaw.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\018e4cd2137de20e2142fd999d9befdf_JaffaCakes118.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:2140

C:\Windows\system32\wscript.exe
wscript C:\Users\Admin\lcxjxwgqpx.js
2⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Program Files\Java\jre7\bin\javaw.exe
"C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\adytbydbr.txt"
3⤵
PID:2656

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\adytbydbr.txt
Filesize
332KB

MD5
af7f264ed40f293a01ee685ee7d42daf

SHA1
a20caef9550c2ae144529b60598b5f58e63a409a

SHA256
2436fa28a278522c298b3a398ddc553c96c4be29ae7b433a999ad49ac71d656c

SHA512
05a060fe3d4b9f92180987d742e5ecad0deb1c5d2cbb1deec0fb31af8ddc5aa867b73ac0b9af02a764c453ba50fc4e9bd6d42b83b294a9e9bcf91b32c34ded7d

Download Submit
C:\Users\Admin\lcxjxwgqpx.js
Filesize
634KB

MD5
65225b9f3a8c18d88929b65409c24f6b

SHA1
0e67e77a99ce04077739672198a0b29f43790dfb

SHA256
2b668f355b8bacb7aebb291c83808a557700807d441564f78784debd86e3e2cc

SHA512
6ba01958b389e8a618732992a6f1f37f19ace63284278d9c7966a1668301d7ad4e48385d19a76db9907b4e7484ba960510041ab2a1a21f9fca9b2e5e5f86a6fd

Download Submit
memory/2140-6-0x0000000002720000-0x0000000005720000-memory.dmp

Filesize
48.0MB

Download
memory/2140-12-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2656-24-0x00000000025F0000-0x00000000055F0000-memory.dmp

Filesize
48.0MB

Download
memory/2656-26-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2656-27-0x00000000025F0000-0x00000000055F0000-memory.dmp

Filesize
48.0MB

Download