Analysis
- max time kernel
148s - max time network
147s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
16/08/2024, 21:55
General
- Target Client.exe
- Size 64KB
- Sample240816-1s92qsshkq
- SHA256 01d563a352b6b8bf1eed8e7c7130a8291a87455a899de8827ceae636d4c66bca
Malware Config
Signatures
- EagleRat
An open source modular remote access trojan written in C#.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1832-10-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/1832-11-0x0000000002D90000-0x0000000002D91000-memory.dmp
memory/2520-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp
memory/2520-1-0x00000000012E0000-0x00000000012F6000-memory.dmp
memory/2520-3-0x0000000000580000-0x000000000059A000-memory.dmp
memory/2520-2-0x0000000000320000-0x0000000000332000-memory.dmp
memory/2520-4-0x0000000074D90000-0x000000007547E000-memory.dmp
memory/2520-5-0x0000000074D9E000-0x0000000074D9F000-memory.dmp
memory/2520-6-0x0000000074D90000-0x000000007547E000-memory.dmp
memory/2520-7-0x0000000000A10000-0x0000000000A1A000-memory.dmp
memory/2520-8-0x0000000000AA0000-0x0000000000AAA000-memory.dmp
memory/2520-9-0x0000000000B00000-0x0000000000B08000-memory.dmp