dd373_dll
Behavioral task
behavioral1
Sample
b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867.exe
Resource
win10v2004-20241007-en
General
-
Target
b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867.exe
-
Size
68KB
-
MD5
04485ee0f0313f990255aa4a06546abb
-
SHA1
fa87b9a7b914c11fb75b775e391a3ad46d4eb432
-
SHA256
b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867
-
SHA512
d95011d0bbae4c63ab0acf26568d0759990f26ed87dbc60ed01fdb840477519adb931feff6a6029c0b32d4ba4623ef2951ca260fcfabc609b364f51f775f024b
-
SSDEEP
768:BCB8S+OR7dOahyoHokBtqN74W7bZZmYb9PyzcjRlYlwa6NVdkPnJJMI4V:BHJaAoHoc2x7bZoYBAcQlwJdME
Malware Config
Extracted
runningrat
Signatures
-
RunningRat payload 1 IoCs
resource yara_rule sample family_runningrat -
Runningrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867.exe
Files
-
b10884a495070c2f9ee183bbbb6d1b8f7351fc75d094f4bb212c38c859a6e867.exe.exe windows:4 windows x86 arch:x86
1b365823829e2ac9bfb0aa5d328240a4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
kernel32
HeapAlloc
SetUnhandledExceptionFilter
CreateThread
WaitForSingleObject
ExitProcess
CloseHandle
GetProcessHeap
GetProcAddress
LoadLibraryA
HeapReAlloc
VirtualFree
FreeLibrary
VirtualAlloc
IsBadReadPtr
Exports
Exports
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ