Analysis
-
max time kernel
147s -
max time network
272s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-12-2024 16:40
Static task
static1
Behavioral task
behavioral1
Sample
Interop.NATUPNPLib.dll
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
LICENSE
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Mono.Cecil.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Vestris.ResourceLib.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
client.exe
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
xRAT 2.exe
Resource
win11-20241007-en
General
-
Target
xRAT 2.exe
-
Size
1.2MB
-
MD5
6d8489e8ef02f1dd5d496bfa3a4ff48f
-
SHA1
d8df172354f75d100db674e52654f35f53129e5e
-
SHA256
63c0c9e03586b36bba16e6cd2f73a71d675f39e9a4c87b09aaa2253cb763c833
-
SHA512
99f3ecbf5b4596f663d7b6bd9bb28e0967de33ebbc08b02272ed4a5fc0ef29bc04cf3a6537ca6e2ec5dc7acba9a0326708e0f09be9c86b827d670e833ee51e40
-
SSDEEP
6144:WhPmJabS3OVcLGRk0EiDsQYGhbcEJks7lOFqKGhIax2WbcGILJPO2JkfTKIf941:y+mk4sQFNl/lcGWBJkA
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4588 xRAT 2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4588 xRAT 2.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4588 xRAT 2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635B
MD5b71943f686068b294a9492f883ac844d
SHA1eb356cf8c2305c0e1f8b631646eb43163f2af175
SHA256fe0f805fda8596b27d72627e0b3bc4abf4a318adcb454f69d836a405517e0644
SHA51263fa04538e91dc64c3124228d02f02f069c3d12f0530c4eb42cd66a361ec3afd9b1180bfc72d52f38030d24c004e60fcfe1b03298addcac5fb433dcfe49a7c96
-
Filesize
867B
MD579f02b3fd61af72b58e40f8cb81f6f7d
SHA120a47f8c268ae3a996f1551091f6be412895a9f9
SHA25677d4c6c7a25feb385f8f30e21acec910b0b9818b189ffbe5c0ad3011e519f5b2
SHA512f3f93e5eea7f734cc1ee3e024874a7d0715845eb660bad6fb02106610b87ec4dcb8ee2abebed6fcb128b3ec68fcb43544abe95b1d63817457b3622edceaa998e
-
Filesize
393B
MD5c2fd64e9c69c2898d27653b3b47db2ff
SHA1610f9e4105fbf0f668897bec7be77b8bf708a6ae
SHA256f07f40e283e8d07742a7743dcd5de22933e1c6a6e39513fe0164cd8a910fa030
SHA51277f8c240db2afef34228e3cc59a2d46a18e5f757d8e20ae670dd1ca4eb420757afa5b7003e5ae8ef98806b52605c8828393418b7ba6f120267303d611630d664