runningrat | 1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412 | Triage

Sharing

General

Target

1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412
Size

48KB
Sample

240615-jneatssgkg
MD5

7f0bf23db6496335d9adf01fb50ec091
SHA1

92ba1a47b40306bf5e4027506c7683ab3577fb73
SHA256

1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412
SHA512

f62a8b136cec137784692547bb7259e36592dd474c16914683f872ab30f482d8acf6a2064c996515c1c99b3337c15b4d0c85fe971cd599c8e9aa54b5822f40df
SSDEEP

768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ThPC:Ub1MsHz3JDwhyWr+N95OTga6I

Score

10^/10

runningrat persistence

Malware Config

Targets

- Target
  
  1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412
- Size
  
  48KB
- MD5
  
  7f0bf23db6496335d9adf01fb50ec091
- SHA1
  
  92ba1a47b40306bf5e4027506c7683ab3577fb73
- SHA256
  
  1f2e39728d627019c482b270eabb614d39100ed910797c6884fc405ae6514412
- SHA512
  
  f62a8b136cec137784692547bb7259e36592dd474c16914683f872ab30f482d8acf6a2064c996515c1c99b3337c15b4d0c85fe971cd599c8e9aa54b5822f40df
- SSDEEP
  
  768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ThPC:Ub1MsHz3JDwhyWr+N95OTga6I
Score

8^/10

persistence
- Sets DLL path for service in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2