runningrat | d1347d9e940bd05c1e34f37c9c716314b88fe6edd243719307df79dbaaedebfd | Triage

Sharing

General

Target

2e942eab2c5befacb890b69e79044057.exe
Size

48KB
Sample

240927-pbyftsthqa
MD5

2e942eab2c5befacb890b69e79044057
SHA1

4d920e9e3b579ecff2169e245349ff04cee06a91
SHA256

d1347d9e940bd05c1e34f37c9c716314b88fe6edd243719307df79dbaaedebfd
SHA512

32393b0f360b6abb0e8fcfb5884a92225d3bbcfa0cd62eba8740f3681d08dc1fb240942c8ce928de857506f417198a1c9730f2b48c4c97c021e75275ec12ae1f
SSDEEP

768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67hhPC:Ub1MsHz3JDwhyWr+N95OTga6C

Score

10^/10

runningrat discovery persistence

Malware Config

Targets

- Target
  
  2e942eab2c5befacb890b69e79044057.exe
- Size
  
  48KB
- MD5
  
  2e942eab2c5befacb890b69e79044057
- SHA1
  
  4d920e9e3b579ecff2169e245349ff04cee06a91
- SHA256
  
  d1347d9e940bd05c1e34f37c9c716314b88fe6edd243719307df79dbaaedebfd
- SHA512
  
  32393b0f360b6abb0e8fcfb5884a92225d3bbcfa0cd62eba8740f3681d08dc1fb240942c8ce928de857506f417198a1c9730f2b48c4c97c021e75275ec12ae1f
- SSDEEP
  
  768:zynb12Aw5J6HC4kq5Jp9bjAzhyY55J+NStcEeUlyqgZl4p67hhPC:Ub1MsHz3JDwhyWr+N95OTga6C
Score

8^/10

discovery persistence
- Server Software Component: Terminal Services DLL
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence