Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-12-2024 18:53
Static task
static1
Behavioral task
behavioral1
Sample
rat.bat
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
rat.bat
-
Size
110B
-
MD5
fb5861fcad26ea1112c57fa081429279
-
SHA1
3ee89eb0e963b470e14489dc54eac751250c3207
-
SHA256
9cf43c9bb0ff2742ab02f2adc11a34b44ddc816320d17baf44d2944b1aa98117
-
SHA512
f6e335a48e5bc6c7601b2546e3d2d3689e89f831d17f252a057e43b0f6b0d0c9c9a7f28221db78c077bcfb0750ac6ce14360dfc3322640e4ed3f97e91f1de297
Malware Config
Signatures
-
Possible privilege escalation attempt 2 IoCs
pid Process 2108 takeown.exe 3052 icacls.exe -
Deletes itself 1 IoCs
pid Process 1600 cmd.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2108 takeown.exe 3052 icacls.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe Token: SeTakeOwnershipPrivilege 2108 takeown.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2108 1600 cmd.exe 31 PID 1600 wrote to memory of 2108 1600 cmd.exe 31 PID 1600 wrote to memory of 2108 1600 cmd.exe 31 PID 1600 wrote to memory of 3052 1600 cmd.exe 34 PID 1600 wrote to memory of 3052 1600 cmd.exe 34 PID 1600 wrote to memory of 3052 1600 cmd.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\rat.bat"1⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\system32\takeown.exetakeown /f C:\ /r /d y2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\system32\icacls.exeicacls C:\ /grant administrators:F /t2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3052
-