milleniumrat | db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2

General

Target

db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
Size

5.6MB
MD5

731812403191b60503e017d88e23b1a3
SHA1

67e1c24ded75620181916dea9654eeddf4049525
SHA256

db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2
SHA512

1ae78e7d5e134d56ebbe9ec3e71bd7529aedbe5670a93b7728eca0aa482ac6688187884c5a61c2c8ef308acda555152d4d5cd2938d1cfa57303a8649803f01d5
SSDEEP

98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6m:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciK

Score

10^/10

milleniumrat discovery persistence rat stealer

Malware Config

Signatures

MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat
Milleniumrat family
milleniumrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Update.exedb874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe

Executes dropped EXE 1 IoCs

Processes:

Update.exe

pid process

3144 Update.exe
Loads dropped DLL 2 IoCs

Processes:

db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exeUpdate.exe

pid process

1744 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
3144 Update.exe

pid	process
3144	Update.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

16 raw.githubusercontent.com
17 raw.githubusercontent.com
27 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com
Enumerates processes with tasklist 1 TTPs 1 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3648 tasklist.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

540 timeout.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

4584 reg.exe

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
27	raw.githubusercontent.com

flow	ioc
3	ip-api.com

pid	process
3648	tasklist.exe

pid	process
540	timeout.exe

pid	process
4584	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exeUpdate.exe

pid	process
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe
3144	Update.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exetasklist.exeUpdate.exe

description	pid	process
Token: SeDebugPrivilege	1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
Token: SeDebugPrivilege	3648	tasklist.exe
Token: SeDebugPrivilege	3144	Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Update.exe

pid process

3144 Update.exe

pid	process
3144	Update.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.execmd.exeUpdate.execmd.exe

description	pid	process	target process
PID 1744 wrote to memory of 1956	1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe	cmd.exe
PID 1744 wrote to memory of 1956	1744	db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe	cmd.exe
PID 1956 wrote to memory of 3648	1956	cmd.exe	tasklist.exe
PID 1956 wrote to memory of 3648	1956	cmd.exe	tasklist.exe
PID 1956 wrote to memory of 4048	1956	cmd.exe	find.exe
PID 1956 wrote to memory of 4048	1956	cmd.exe	find.exe
PID 1956 wrote to memory of 540	1956	cmd.exe	timeout.exe
PID 1956 wrote to memory of 540	1956	cmd.exe	timeout.exe
PID 1956 wrote to memory of 3144	1956	cmd.exe	Update.exe
PID 1956 wrote to memory of 3144	1956	cmd.exe	Update.exe
PID 3144 wrote to memory of 2292	3144	Update.exe	cmd.exe
PID 3144 wrote to memory of 2292	3144	Update.exe	cmd.exe
PID 2292 wrote to memory of 4584	2292	cmd.exe	reg.exe
PID 2292 wrote to memory of 4584	2292	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe
"C:\Users\Admin\AppData\Local\Temp\db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 1744"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4048
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:540
- - C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
    "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp955A.tmp.bat

Filesize
256B

MD5
b36d0218cd6b983b998b222cad1f037d

SHA1
160bba564ae8c32ea31703d3e7e08233c493a9c2

SHA256
f4be5391e36eb5724bdd187c6cca4386aa2e6bc88251dbe9349c206a48a8103d

SHA512
211706abd26108c31b30dd1c6a8661227d2edea4e84450b8956a8b303f671b4c6c1e1de3b54adfac7700d7326901f9f7b39ba45ab749d98c4e52ab14240b3615

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe

Filesize
5.6MB

MD5
731812403191b60503e017d88e23b1a3

SHA1
67e1c24ded75620181916dea9654eeddf4049525

SHA256
db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2

SHA512
1ae78e7d5e134d56ebbe9ec3e71bd7529aedbe5670a93b7728eca0aa482ac6688187884c5a61c2c8ef308acda555152d4d5cd2938d1cfa57303a8649803f01d5

Download Submit
memory/1744-0-0x00007FF9CF883000-0x00007FF9CF885000-memory.dmp

Filesize
8KB

Download
memory/1744-1-0x000001F1635B0000-0x000001F163B50000-memory.dmp

Filesize
5.6MB

Download
memory/1744-6-0x000001F17DFE0000-0x000001F17E056000-memory.dmp

Filesize
472KB

Download
memory/1744-7-0x00007FF9CF880000-0x00007FF9D0341000-memory.dmp

Filesize
10.8MB

Download
memory/1744-8-0x000001F165740000-0x000001F16575E000-memory.dmp

Filesize
120KB

Download
memory/1744-12-0x00007FF9CF880000-0x00007FF9D0341000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads