Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 21:34
Behavioral task
behavioral1
Sample
ratremover.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ratremover.exe
Resource
win10v2004-20241007-en
General
-
Target
ratremover.exe
-
Size
7.6MB
-
MD5
86d3386f1c3741e7bf7c3b49fd54ef4c
-
SHA1
4c2a7901ea11b96d44831ad473a4fe13fec964c7
-
SHA256
d71b0488ad6ce4579d90b22ed8921fc837ffc77781de183da7a7a30369db5ed1
-
SHA512
8467abddee54c2d77bae0c19f06da49eacda544704f9ddef259936d4f0d8150c367ed5d84b15d1fe5b25b2e3397bca26b53164c0fe0674397f44b109224c5368
-
SSDEEP
196608:NZD+kd2QwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWR:35gPIHL7HmBYXrYoaUNm
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2328 ratremover.exe -
resource yara_rule behavioral1/files/0x00050000000195ca-21.dat upx behavioral1/memory/2328-23-0x000007FEF5EE0000-0x000007FEF6545000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2328 2480 ratremover.exe 30 PID 2480 wrote to memory of 2328 2480 ratremover.exe 30 PID 2480 wrote to memory of 2328 2480 ratremover.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59a3d3ae5745a79d276b05a85aea02549
SHA1a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA25609693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
SHA51246840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69