Resubmissions
13/01/2025, 00:14
250113-ajgeysynen1001/10/2024, 16:24
241001-twvynayfpr1027/09/2024, 00:57
240927-bawzqaxamj1026/09/2024, 23:29
240926-3gqj3awfpc1026/09/2024, 18:54
240926-xkc59avhjh1026/09/2024, 18:38
240926-w945lavbqe1026/09/2024, 16:26
240926-txsvpazdng10Analysis
- max time kernel
464s - max time network
455s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
26/09/2024, 16:26
General
- Target 888 Rat v1.2.6/888 Rat v1.2.6.exe
- Size 75.0MB
- Sample240926-txsvpazdng
- SHA256 5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 4 IoCs
- AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6\888 Rat v1.2.6.exe"C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6\888 Rat v1.2.6.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Splash8.jpg
autB879.tmp
skin.888ww.msstyles
memory/2764-44-0x000000000E060000-0x000000000E11B000-memory.dmp
memory/2764-51-0x0000000076330000-0x00000000763AC000-memory.dmp
memory/2764-54-0x0000000076330000-0x00000000763AC000-memory.dmp
memory/2764-53-0x0000000076330000-0x00000000763AC000-memory.dmp
memory/2764-57-0x0000000077B40000-0x0000000077B65000-memory.dmp
memory/2764-56-0x0000000076330000-0x00000000763AC000-memory.dmp
memory/2764-52-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-60-0x0000000077B40000-0x0000000077B65000-memory.dmp
memory/2764-59-0x0000000076330000-0x00000000763AC000-memory.dmp
memory/2764-50-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-62-0x0000000077B40000-0x0000000077B65000-memory.dmp
memory/2764-64-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-63-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-58-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-66-0x0000000076A90000-0x0000000076BDD000-memory.dmp
memory/2764-65-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-55-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-68-0x00000000776B0000-0x000000007778F000-memory.dmp
memory/2764-73-0x0000000076A90000-0x0000000076BDD000-memory.dmp
memory/2764-72-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-71-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-70-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-69-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-61-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-82-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-81-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-79-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-78-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-84-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-87-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-86-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-74-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-85-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-77-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-76-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-75-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-80-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-67-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-92-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-91-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-90-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-89-0x00000000776B0000-0x000000007778F000-memory.dmp
memory/2764-83-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-94-0x0000000076A90000-0x0000000076BDD000-memory.dmp
memory/2764-93-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-98-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-88-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-105-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-106-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-104-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-95-0x0000000000660000-0x000000000515D000-memory.dmp
memory/2764-103-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-102-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-99-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-101-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-100-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-97-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-96-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-111-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-110-0x00000000770A0000-0x00000000776A2000-memory.dmp
memory/2764-109-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-114-0x0000000077870000-0x000000007792F000-memory.dmp
memory/2764-115-0x00000000750F0000-0x0000000075172000-memory.dmp
memory/2764-113-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-108-0x0000000075680000-0x00000000758A3000-memory.dmp
memory/2764-133-0x000000000E060000-0x000000000E11B000-memory.dmp