runningrat | 0498fe1b3c0866a85b0b9c653800877da139973d6b60646f99f00e014bbb71e7 | Triage

Sharing

General

Target

0498fe1b3c0866a85b0b9c653800877da139973d6b60646f99f00e014bbb71e7
Size

48KB
Sample

240615-jngqyssglc
MD5

eff3e0fad856f7bed3f7ef76e355b75e
SHA1

ac9fc470156acc577e6b5e889b6d28bb12e39db8
SHA256

0498fe1b3c0866a85b0b9c653800877da139973d6b60646f99f00e014bbb71e7
SHA512

458ac1d27e70a2fbee1e5c8abb3d1b1fb0c093f57e06d3401a0e45bbc32d619afccbc21ca2d70a694eb173e17f1a46b7a59fdcdfa933618d4f4701e0909bf7b4
SSDEEP

768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ChPC:Ub1MsHz3JDwhyWr+N95OTga6p

Score

10^/10

runningrat persistence

Malware Config

Targets

- Target
  
  0498fe1b3c0866a85b0b9c653800877da139973d6b60646f99f00e014bbb71e7
- Size
  
  48KB
- MD5
  
  eff3e0fad856f7bed3f7ef76e355b75e
- SHA1
  
  ac9fc470156acc577e6b5e889b6d28bb12e39db8
- SHA256
  
  0498fe1b3c0866a85b0b9c653800877da139973d6b60646f99f00e014bbb71e7
- SHA512
  
  458ac1d27e70a2fbee1e5c8abb3d1b1fb0c093f57e06d3401a0e45bbc32d619afccbc21ca2d70a694eb173e17f1a46b7a59fdcdfa933618d4f4701e0909bf7b4
- SSDEEP
  
  768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67ChPC:Ub1MsHz3JDwhyWr+N95OTga6p
Score

8^/10

persistence
- Sets DLL path for service in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2