Analysis
-
max time kernel
123s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/09/2024, 13:20
General
-
Target
Thanks For Purchase/S-400 [EXTRACT]/S-400 RAT v3.0.exe
-
Size
10.7MB
-
MD5
a39a575da05f3dddeda3508b992f41ee
-
SHA1
1cfb7c32b81d22d6bded1bcfe07e6b86769df7f0
-
SHA256
69d72335bc69e00572e589826b8b8bcce4596df75c6f8ceae6f1c6745af3ef95
-
SHA512
2bae0dcbeb9f28c2f20ad5e5103eaf4d6824d4a7f33f59e57f9ac151c898089f919c6e5ef980a56d4025ee32812ce985be0b3d7799ca72f1851caffae749683a
-
SSDEEP
98304:/WZ2Pm4Jyohom4JyP0H0ouruYXn6bX2gso4TQqW0KRXdLbnm4Jy:/Wkv/hivDpbXxCQqWlPX
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Loads dropped DLL 1 IoCs
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Thanks For Purchase\S-400 [EXTRACT]\S-400 RAT v3.0.exe"C:\Users\Admin\AppData\Local\Temp\Thanks For Purchase\S-400 [EXTRACT]\S-400 RAT v3.0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4252,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD59af5eb006bb0bab7f226272d82c896c7
SHA1c2a5bb42a5f08f4dc821be374b700652262308f0
SHA25677dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db
SHA5127badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a
-
Filesize
1.9MB
-
Filesize
548KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
220KB
-
Filesize
10.8MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
220KB