Analysis
-
max time kernel
1800s -
max time network
1508s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
28-04-2024 21:10
General
-
Target
888-RAT [Lifetime Activated]/data/command-reciever.exe
-
Size
79.2MB
-
MD5
e9aa901042053b06723f6e14f95fe3c6
-
SHA1
f7653cb6fc7c6dd17900abdc7a4307570aca50d6
-
SHA256
f4023630eddd4ee944149279d641604764e442592d98b9720874c69e02d84fb5
-
SHA512
272410435e51a59856cd9dcf7bfba852a9d7055a71fff00491ad45eab9025799a97bebfcdcaab787b17c35263edb9e0b36df63cbcf190969092c2f355406a313
-
SSDEEP
1572864:9+geRT13w3TbMlFaT9re/8v1qrqxXlUcFY3rT4FDfhPMETIuCNBrO:9+r13wmgJr0YlUcFYglfhPYS
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 4 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888-RAT [Lifetime Activated]\data\command-reciever.exe"C:\Users\Admin\AppData\Local\Temp\888-RAT [Lifetime Activated]\data\command-reciever.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aut6B24.tmpFilesize
239KB
MD529e1d5770184bf45139084bced50d306
SHA176c953cd86b013c3113f8495b656bd721be55e76
SHA256794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307
SHA5127cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8
-
C:\Users\Admin\AppData\Local\Temp\skin.888ww.msstylesFilesize
3.3MB
MD5ea5d5266b8a7bcc8788c83ebb7c8c7d5
SHA13e9ac1ab7d5d54db9b3d141e82916513e572b415
SHA25691ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1
SHA512404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60
-
memory/1732-46-0x0000000005200000-0x00000000052BB000-memory.dmpFilesize
748KB
-
memory/1732-52-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-64-0x0000000075E20000-0x0000000075E45000-memory.dmpFilesize
148KB
-
memory/1732-66-0x0000000076850000-0x000000007690F000-memory.dmpFilesize
764KB
-
memory/1732-82-0x0000000076850000-0x000000007690F000-memory.dmpFilesize
764KB
-
memory/1732-81-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-87-0x0000000076850000-0x000000007690F000-memory.dmpFilesize
764KB
-
memory/1732-65-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-116-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-115-0x0000000075E50000-0x0000000075F9D000-memory.dmpFilesize
1.3MB
-
memory/1732-114-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-111-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-110-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-105-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-104-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-103-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-112-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-107-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-109-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-108-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-106-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-101-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-100-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-98-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-94-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-92-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-88-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-86-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-85-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-84-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-79-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-78-0x0000000076850000-0x000000007690F000-memory.dmpFilesize
764KB
-
memory/1732-77-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-76-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-75-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-74-0x0000000075E50000-0x0000000075F9D000-memory.dmpFilesize
1.3MB
-
memory/1732-71-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-70-0x0000000076B50000-0x0000000076C2F000-memory.dmpFilesize
892KB
-
memory/1732-67-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-102-0x0000000074C90000-0x0000000074EB3000-memory.dmpFilesize
2.1MB
-
memory/1732-99-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-97-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-96-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-95-0x0000000075E50000-0x0000000075F9D000-memory.dmpFilesize
1.3MB
-
memory/1732-93-0x0000000076850000-0x000000007690F000-memory.dmpFilesize
764KB
-
memory/1732-91-0x0000000076B50000-0x0000000076C2F000-memory.dmpFilesize
892KB
-
memory/1732-90-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-89-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-83-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-80-0x00000000746E0000-0x0000000074762000-memory.dmpFilesize
520KB
-
memory/1732-73-0x0000000075300000-0x0000000075902000-memory.dmpFilesize
6.0MB
-
memory/1732-72-0x0000000076850000-0x000000007690F000-memory.dmpFilesize
764KB
-
memory/1732-69-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-68-0x0000000075E50000-0x0000000075F9D000-memory.dmpFilesize
1.3MB
-
memory/1732-63-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-62-0x0000000075E20000-0x0000000075E45000-memory.dmpFilesize
148KB
-
memory/1732-59-0x0000000075E20000-0x0000000075E45000-memory.dmpFilesize
148KB
-
memory/1732-58-0x0000000075280000-0x00000000752FC000-memory.dmpFilesize
496KB
-
memory/1732-57-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-56-0x0000000075280000-0x00000000752FC000-memory.dmpFilesize
496KB
-
memory/1732-55-0x0000000075280000-0x00000000752FC000-memory.dmpFilesize
496KB
-
memory/1732-54-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-53-0x0000000075280000-0x00000000752FC000-memory.dmpFilesize
496KB
-
memory/1732-61-0x0000000075280000-0x00000000752FC000-memory.dmpFilesize
496KB
-
memory/1732-60-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/1732-127-0x0000000005200000-0x00000000052BB000-memory.dmpFilesize
748KB