runningrat | acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23 | Triage

Sharing

General

Target

acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23
Size

48KB
Sample

240615-jnp3bssgmh
MD5

483fe860119307c2f9e2f7ed4caadc81
SHA1

b5fa21f06419e585cb9faa7227f1931a8521ca5f
SHA256

acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23
SHA512

4590310719d9a253e71dcb46775029d1213c87f21d6d002ec78584cc5eece9fdf169af174ae287a9328c81c1699927b552fdb1b4b8d1b59f706511ae48b142c7
SSDEEP

768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67dhPC:Ub1MsHz3JDwhyWr+N95OTga6u

Score

10^/10

runningrat persistence

Malware Config

Targets

- Target
  
  acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23
- Size
  
  48KB
- MD5
  
  483fe860119307c2f9e2f7ed4caadc81
- SHA1
  
  b5fa21f06419e585cb9faa7227f1931a8521ca5f
- SHA256
  
  acee72d648216217f6208a6d648767f06252a72aa3a8f4bf88de049eecb27c23
- SHA512
  
  4590310719d9a253e71dcb46775029d1213c87f21d6d002ec78584cc5eece9fdf169af174ae287a9328c81c1699927b552fdb1b4b8d1b59f706511ae48b142c7
- SSDEEP
  
  768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67dhPC:Ub1MsHz3JDwhyWr+N95OTga6u
Score

8^/10

persistence
- Sets DLL path for service in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2