Overview
overview
10Static
static
10BoratRat_Cracked.exe
windows7-x64
10BoratRat_Cracked.exe
windows10-2004-x64
10bin/Audio.dll
windows7-x64
1bin/Audio.dll
windows10-2004-x64
1bin/Discord.dll
windows7-x64
1bin/Discord.dll
windows10-2004-x64
1bin/Extra.dll
windows7-x64
1bin/Extra.dll
windows10-2004-x64
1bin/FileManager.dll
windows7-x64
1bin/FileManager.dll
windows10-2004-x64
1bin/FileSearcher.dll
windows7-x64
1bin/FileSearcher.dll
windows10-2004-x64
1bin/Fun.dll
windows7-x64
1bin/Fun.dll
windows10-2004-x64
1bin/Information.dll
windows7-x64
1bin/Information.dll
windows10-2004-x64
1bin/Keylogger.exe
windows7-x64
1bin/Keylogger.exe
windows10-2004-x64
1bin/Logger.dll
windows7-x64
1bin/Logger.dll
windows10-2004-x64
1bin/Messag...ib.dll
windows7-x64
1bin/Messag...ib.dll
windows10-2004-x64
1bin/Miscellaneous.dll
windows7-x64
1bin/Miscellaneous.dll
windows10-2004-x64
1bin/Netstat.dll
windows7-x64
1bin/Netstat.dll
windows10-2004-x64
1bin/Options.dll
windows7-x64
1bin/Options.dll
windows10-2004-x64
1bin/Proces...er.dll
windows7-x64
1bin/Proces...er.dll
windows10-2004-x64
1bin/Ransomware.dll
windows7-x64
1bin/Ransomware.dll
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
06-08-2024 11:06
Behavioral task
behavioral1
Sample
BoratRat_Cracked.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
BoratRat_Cracked.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
bin/Audio.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
bin/Audio.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
bin/Discord.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
bin/Discord.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
bin/Extra.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
bin/Extra.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
bin/FileManager.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
bin/FileManager.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
bin/FileSearcher.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
bin/FileSearcher.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
bin/Fun.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
bin/Fun.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
bin/Information.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
bin/Information.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
bin/Keylogger.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
bin/Keylogger.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
bin/Logger.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
bin/Logger.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
bin/MessagePackLib.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
bin/MessagePackLib.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
bin/Miscellaneous.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
bin/Miscellaneous.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
bin/Netstat.dll
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
bin/Netstat.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
bin/Options.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
bin/Options.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
bin/ProcessManager.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
bin/ProcessManager.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
bin/Ransomware.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
bin/Ransomware.dll
Resource
win10v2004-20240802-en
General
-
Target
BoratRat_Cracked.exe
-
Size
20.0MB
-
MD5
c68cf8d1c438a9c59878deb36d17e197
-
SHA1
fc6158fbab2762f1da42c7a486fd04bd8b547f05
-
SHA256
9e7e71f470c44d253d72a78f1ccdde34b4a0bff6242d86006cd6e364b6bbf79c
-
SHA512
67bad918bf1b4d1d1461ae949c7ef9e953fe447df46e7d32484914ef74cc658d8746b5bb2fb354f8c07fb961d9e4b395e7c2dab4e49e6b26d0af51aad5b27ccf
-
SSDEEP
393216:nm2XTCP+Zw6NLIsFfskh1BmXGnfBd+Ly:nmmTCP+Zlnk0rmkBYLy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1716 Client.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe BoratRat_Cracked.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe BoratRat_Cracked.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 63 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5200310000000000e4587ba7122041707044617461003c0008000400efbee4587ba7e4587ba72a000000f40100000000020000000000000000000000000000004100700070004400610074006100000016000000 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7400310000000000e4587ba71100557365727300600008000400efbeee3a851ae4587ba72a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c00310000000000e45872ab100041646d696e00380008000400efbee4587ba7e45872ab2a00000038000000000003000000000000000000000000000000410064006d0069006e00000014000000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a003100000000000659f058102054656d700000360008000400efbee4587ba70659f0582a00000008020000000002000000000000000000000000000000540065006d007000000014000000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000000659f35810204c6f63616c00380008000400efbee4587ba70659f3582a000000070200000000020000000000000000000000000000004c006f00630061006c00000014000000 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BoratRat_Cracked.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2244 BoratRat_Cracked.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2244 BoratRat_Cracked.exe Token: SeDebugPrivilege 1716 Client.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe 1716 Client.exe 1716 Client.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2244 BoratRat_Cracked.exe 2244 BoratRat_Cracked.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2244 BoratRat_Cracked.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2244
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2416
-
C:\Users\Admin\Desktop\Client.exe"C:\Users\Admin\Desktop\Client.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Server\BoratRat_Cracked.exe_Url_wi0iqtchtc4kqw3og201wkj2ust21obp\1.0.7.0\user.config
Filesize309B
MD50c6e4f57ebaba0cc4acfc8bb65c589f8
SHA18c021c2371b87f2570d226b419c64c3102b8d434
SHA256a9539ba4eae9035b2ff715f0e755aa772b499d72ccab23af2bf5a2dc2bcfa41c
SHA512c6b877ff887d029e29bf35f53006b8c84704f73b74c616bf97696d06c6ef237dff85269bdf8dfb432457b031dd52410e2b883fd86c3f54b09f0a072a689a08c0
-
C:\Users\Admin\AppData\Local\Server\BoratRat_Cracked.exe_Url_wi0iqtchtc4kqw3og201wkj2ust21obp\1.0.7.0\user.config
Filesize580B
MD5acb6df8bd0fe9236ea87ea6e3c28173f
SHA18b1d88bd749b58905c6db258e7224a67d1179938
SHA256ec2b3fc4d011e9b8a04188d8f2ff280de854dde7d6ebf8e871e0642f789dfa5b
SHA512a4222c0f5aeba58679c21361dcb6ab2c7ed1d9cae41d2839089fdb7bbaac3b8735afff8b302557f85389daa977b826cee77b944ba598e3fa6c2a16781453a832
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD59fdc5bf10b448a549b9bd1cac87339b8
SHA137a950f11ec8106a8d8605821a1cf90c7424072e
SHA2569ab0c40a3cd77716165d701988049168281bce9819a36781e5cdeafcf264b9ed
SHA5125beec295ee1fa050b918ef64620b75bd273de3b3bf01c913c33e88960a172fd9245da39c78eeeba7709d8ff8711ec4c4eff56ca47c0005442f6afc9116924e84
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
56KB
MD5b385e7d9aa37eb43cf97b622eda20146
SHA18703a917ef11726ead2597b14c79a4f6e083cccd
SHA256da5421adcba64cd3eeafdd61ab8202fa0379f620f88cfa318acc07a03dca9e9a
SHA51255b315f1df56e6f3eed57d1d71ed7de0888367a0ffef1e6175f20b3fbf8affaaeb849cf5e17105d4956c38a595e54975692a36d5961acad3a19fa0651b8770e8