Analysis
-
max time kernel
63s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 13:30
Static task
static1
Behavioral task
behavioral1
Sample
official rat by e1dar.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
official rat by e1dar.exe
Resource
win10v2004-20241007-en
General
-
Target
official rat by e1dar.exe
-
Size
800KB
-
MD5
02c70d9d6696950c198db93b7f6a835e
-
SHA1
30231a467a49cc37768eea0f55f4bea1cbfb48e2
-
SHA256
8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3
-
SHA512
431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb
-
SSDEEP
12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation official rat by e1dar.exe Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation BootstrapperV2.04.exe -
Executes dropped EXE 2 IoCs
pid Process 2704 BootstrapperV2.04.exe 4456 Solara.exe -
Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 Destination IP 1.0.0.1 -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 54 pastebin.com 55 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2136 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4456 Solara.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4724 WMIC.exe Token: SeSecurityPrivilege 4724 WMIC.exe Token: SeTakeOwnershipPrivilege 4724 WMIC.exe Token: SeLoadDriverPrivilege 4724 WMIC.exe Token: SeSystemProfilePrivilege 4724 WMIC.exe Token: SeSystemtimePrivilege 4724 WMIC.exe Token: SeProfSingleProcessPrivilege 4724 WMIC.exe Token: SeIncBasePriorityPrivilege 4724 WMIC.exe Token: SeCreatePagefilePrivilege 4724 WMIC.exe Token: SeBackupPrivilege 4724 WMIC.exe Token: SeRestorePrivilege 4724 WMIC.exe Token: SeShutdownPrivilege 4724 WMIC.exe Token: SeDebugPrivilege 4724 WMIC.exe Token: SeSystemEnvironmentPrivilege 4724 WMIC.exe Token: SeRemoteShutdownPrivilege 4724 WMIC.exe Token: SeUndockPrivilege 4724 WMIC.exe Token: SeManageVolumePrivilege 4724 WMIC.exe Token: 33 4724 WMIC.exe Token: 34 4724 WMIC.exe Token: 35 4724 WMIC.exe Token: 36 4724 WMIC.exe Token: SeIncreaseQuotaPrivilege 4724 WMIC.exe Token: SeSecurityPrivilege 4724 WMIC.exe Token: SeTakeOwnershipPrivilege 4724 WMIC.exe Token: SeLoadDriverPrivilege 4724 WMIC.exe Token: SeSystemProfilePrivilege 4724 WMIC.exe Token: SeSystemtimePrivilege 4724 WMIC.exe Token: SeProfSingleProcessPrivilege 4724 WMIC.exe Token: SeIncBasePriorityPrivilege 4724 WMIC.exe Token: SeCreatePagefilePrivilege 4724 WMIC.exe Token: SeBackupPrivilege 4724 WMIC.exe Token: SeRestorePrivilege 4724 WMIC.exe Token: SeShutdownPrivilege 4724 WMIC.exe Token: SeDebugPrivilege 4724 WMIC.exe Token: SeSystemEnvironmentPrivilege 4724 WMIC.exe Token: SeRemoteShutdownPrivilege 4724 WMIC.exe Token: SeUndockPrivilege 4724 WMIC.exe Token: SeManageVolumePrivilege 4724 WMIC.exe Token: 33 4724 WMIC.exe Token: 34 4724 WMIC.exe Token: 35 4724 WMIC.exe Token: 36 4724 WMIC.exe Token: SeDebugPrivilege 3588 official rat by e1dar.exe Token: SeDebugPrivilege 2704 BootstrapperV2.04.exe Token: SeDebugPrivilege 4456 Solara.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2704 BootstrapperV2.04.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3588 wrote to memory of 712 3588 official rat by e1dar.exe 84 PID 3588 wrote to memory of 712 3588 official rat by e1dar.exe 84 PID 712 wrote to memory of 2136 712 cmd.exe 86 PID 712 wrote to memory of 2136 712 cmd.exe 86 PID 3588 wrote to memory of 2736 3588 official rat by e1dar.exe 89 PID 3588 wrote to memory of 2736 3588 official rat by e1dar.exe 89 PID 2736 wrote to memory of 4724 2736 cmd.exe 91 PID 2736 wrote to memory of 4724 2736 cmd.exe 91 PID 3588 wrote to memory of 2704 3588 official rat by e1dar.exe 94 PID 3588 wrote to memory of 2704 3588 official rat by e1dar.exe 94 PID 2704 wrote to memory of 4456 2704 BootstrapperV2.04.exe 110 PID 2704 wrote to memory of 4456 2704 BootstrapperV2.04.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\official rat by e1dar.exe"C:\Users\Admin\AppData\Local\Temp\official rat by e1dar.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SYSTEM32\cmd.exe"cmd" /c ipconfig /all2⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2136
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")2⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\System32\Wbem\WMIC.exewmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
-
C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe"C:\Users\Admin\AppData\Local\Temp\BootstrapperV2.04.exe" --oldBootstrapper "C:\Users\Admin\AppData\Local\Temp\official rat by e1dar.exe" --isUpdate true2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\ProgramData\Solara\Solara.exe"C:\ProgramData\Solara\Solara.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
695KB
MD5195ffb7167db3219b217c4fd439eedd6
SHA11e76e6099570ede620b76ed47cf8d03a936d49f8
SHA256e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
SHA51256eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
-
Filesize
133KB
MD5c6f770cbb24248537558c1f06f7ff855
SHA1fdc2aaae292c32a58ea4d9974a31ece26628fdd7
SHA256d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b
SHA512cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a
-
Filesize
5.2MB
MD5aead90ab96e2853f59be27c4ec1e4853
SHA143cdedde26488d3209e17efff9a51e1f944eb35f
SHA25646cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed
SHA512f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d
-
Filesize
2.8MB
MD5be4da425d9b7593e358ffbfca29f9c70
SHA1dc98530aad9728d779866ae957a738c52b13a565
SHA256c5277ddb6e51181d2b8bad59acf5f2badf5613b1e73384a84b793f720aa76c0d
SHA51235790944f5855038f8357c0f6d11ea81b260632e590c26f9342e8beb1a8dfd2e3eb9efa11f8378f8542cad45e7675af3d29cf27424accf35aaa6aeb34487155b