eaglerat | 01d563a352b6b8bf1eed8e7c7130a8291a87455a899de8827ceae636d4c66bca

Resubmissions

16/08/2024, 21:58

240816-1vy29azbra10

16/08/2024, 21:55

240816-1s92qsshkq10

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Client.exe
Size 64KB
Sample240816-1vy29azbra
SHA256 01d563a352b6b8bf1eed8e7c7130a8291a87455a899de8827ceae636d4c66bca
MD5 b4a6426227719a02eab49a8d55adb9da
SHA1 167942cecddd1d349223d36d89f7790e3d3cb2b3
SHA512 5073831114c94d148328123d4506688dbe87316b41ec55386a6554c588d17449dc2035297d42cd6d38796eac9c476d49784bab272196a4b223133ad7a84d9e4e
SSDEEP 768:l9XxYwPAyajomk3IRG2/QVeu7lGj4Qie8ArmEwanRXCVsev1BtLIBfucEf48MzsL:lh3HaMmkefuYjsDAiENQVseNbIB2Vqq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eaglerat discovery rat

Malware Config

Signatures

EagleRat
An open source modular remote access trojan written in C#.
rat eaglerat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	Client.exe
Token: 33	4544	Client.exe
Token: SeIncBasePriorityPrivilege	4544	Client.exe
Token: 33	4544	Client.exe
Token: SeIncBasePriorityPrivilege	4544	Client.exe
Token: SeShutdownPrivilege	4544	Client.exe
Token: 33	4544	Client.exe
Token: SeIncBasePriorityPrivilege	4544	Client.exe
Token: SeShutdownPrivilege	5108	LogonUI.exe
Token: SeCreatePagefilePrivilege	5108	LogonUI.exe
Token: SeShutdownPrivilege	4544	Client.exe
Token: 33	4544	Client.exe
Token: SeIncBasePriorityPrivilege	4544	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4544	Client.exe
5108	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4544

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3970855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LockScreen___1280_0720_notdimmed.jpg

Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-2392887640-1187051047-2909758433-1000\ReadOnly\LockScreen_W\LockScreen___1280_0720_notdimmed.jpg
Size 1.6MB
SHA256 0b8ca78426022d8a7189dcd3e72f72988aa1a79d91d2814415d4b212af7de777
MD5 5641512b0154d1f085a8d9c3cef434fb
SHA1 921a13d3882774d5b038a66ade62700689cbdd3c
SHA512 18d703a09932dda66d20273005051a64e2c8e9b77ae9252cd0564b172a9ae539a076330aa7c17488173aad8bcf206106d339f6b224d30f7def276e181bf0f72e
SSDEEP 49152:jbS40yYZQJdcUvNgaaAuVixzVimudhDqtl:q43YZQJd19uMg7q3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4544-8-0x0000000005640000-0x00000000056DC000-memory.dmp

Download

memory/4544-10-0x00000000056E0000-0x00000000056F2000-memory.dmp

Download

memory/4544-2-0x0000000002A00000-0x0000000002A12000-memory.dmp

Download

memory/4544-4-0x0000000075140000-0x00000000758F0000-memory.dmp

Download

memory/4544-5-0x0000000005710000-0x0000000005CB4000-memory.dmp

Download

memory/4544-6-0x000000007514E000-0x000000007514F000-memory.dmp

Download

memory/4544-7-0x0000000075140000-0x00000000758F0000-memory.dmp

Download

memory/4544-0-0x000000007514E000-0x000000007514F000-memory.dmp

Download

memory/4544-3-0x0000000002B40000-0x0000000002B5A000-memory.dmp

Download

memory/4544-11-0x0000000006120000-0x00000000061B2000-memory.dmp

Download

memory/4544-9-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/4544-12-0x0000000006100000-0x000000000610A000-memory.dmp

Download

memory/4544-13-0x0000000006360000-0x0000000006368000-memory.dmp

Download

memory/4544-14-0x0000000008200000-0x0000000008212000-memory.dmp

Download

memory/4544-15-0x0000000006F10000-0x0000000006F18000-memory.dmp

Download

memory/4544-1-0x0000000000710000-0x0000000000726000-memory.dmp

Download

memory/4544-25-0x0000000075140000-0x00000000758F0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads