Overview
overview
10Static
static
7888 RAT 1.2.5.exe
windows10-1703-x64
10888 RAT 1.2.5.exe
windows7-x64
7888 RAT 1.2.5.exe
windows10-2004-x64
10888 RAT 1.2.5.exe
windows11-21h2-x64
10888 Rat 1....or.exe
windows10-1703-x64
10888 Rat 1....or.exe
windows7-x64
8888 Rat 1....or.exe
windows10-2004-x64
10888 Rat 1....or.exe
windows11-21h2-x64
10888 Rat 1....2).exe
windows10-1703-x64
10888 Rat 1....2).exe
windows7-x64
8888 Rat 1....2).exe
windows10-2004-x64
10888 Rat 1....2).exe
windows11-21h2-x64
10888 rat 1.2.1.exe
windows10-1703-x64
10888 rat 1.2.1.exe
windows7-x64
7888 rat 1.2.1.exe
windows10-2004-x64
7888 rat 1.2.1.exe
windows11-21h2-x64
7Analysis
-
max time kernel
1800s -
max time network
1157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 18:33
Behavioral task
behavioral1
Sample
888 RAT 1.2.5.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
888 RAT 1.2.5.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
888 RAT 1.2.5.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
888 RAT 1.2.5.exe
Resource
win11-20240709-en
Behavioral task
behavioral5
Sample
888 Rat 1.2.4 Cracked By Escanor.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
888 Rat 1.2.4 Cracked By Escanor.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
888 Rat 1.2.4 Cracked By Escanor.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
888 Rat 1.2.4 Cracked By Escanor.exe
Resource
win11-20240709-en
Behavioral task
behavioral9
Sample
888 Rat 1.2.4 Cracked For Lifetime (2).exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
888 Rat 1.2.4 Cracked For Lifetime (2).exe
Resource
win7-20240705-en
Behavioral task
behavioral11
Sample
888 Rat 1.2.4 Cracked For Lifetime (2).exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
888 Rat 1.2.4 Cracked For Lifetime (2).exe
Resource
win11-20240709-en
Behavioral task
behavioral13
Sample
888 rat 1.2.1.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
888 rat 1.2.1.exe
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
888 rat 1.2.1.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
888 rat 1.2.1.exe
Resource
win11-20240709-en
General
-
Target
888 rat 1.2.1.exe
-
Size
79.2MB
-
MD5
e9aa901042053b06723f6e14f95fe3c6
-
SHA1
f7653cb6fc7c6dd17900abdc7a4307570aca50d6
-
SHA256
f4023630eddd4ee944149279d641604764e442592d98b9720874c69e02d84fb5
-
SHA512
272410435e51a59856cd9dcf7bfba852a9d7055a71fff00491ad45eab9025799a97bebfcdcaab787b17c35263edb9e0b36df63cbcf190969092c2f355406a313
-
SSDEEP
1572864:9+geRT13w3TbMlFaT9re/8v1qrqxXlUcFY3rT4FDfhPMETIuCNBrO:9+r13wmgJr0YlUcFYglfhPYS
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\autD8E1.tmp acprotect -
Loads dropped DLL 4 IoCs
Processes:
888 rat 1.2.1.exepid process 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\autD8E1.tmp upx behavioral15/memory/4324-46-0x000000001A0B0000-0x000000001A16B000-memory.dmp upx behavioral15/memory/4324-44-0x000000001A0B0000-0x000000001A16B000-memory.dmp upx behavioral15/memory/4324-135-0x000000001A0B0000-0x000000001A16B000-memory.dmp upx -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral15/memory/4324-53-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-64-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-115-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-103-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-95-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-89-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-78-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-70-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-61-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-55-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral15/memory/4324-58-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
888 rat 1.2.1.exepid process 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
888 rat 1.2.1.exepid process 4324 888 rat 1.2.1.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
888 rat 1.2.1.exepid process 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
888 rat 1.2.1.exepid process 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe 4324 888 rat 1.2.1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
888 rat 1.2.1.exepid process 4324 888 rat 1.2.1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 rat 1.2.1.exe"C:\Users\Admin\AppData\Local\Temp\888 rat 1.2.1.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD529e1d5770184bf45139084bced50d306
SHA176c953cd86b013c3113f8495b656bd721be55e76
SHA256794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307
SHA5127cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8
-
Filesize
3.3MB
MD5ea5d5266b8a7bcc8788c83ebb7c8c7d5
SHA13e9ac1ab7d5d54db9b3d141e82916513e572b415
SHA25691ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1
SHA512404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60