Overview

overview

10

Static

static

3

Dangerous RAT.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250207-en
  • resource tags

    arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    08-02-2025 07:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Dangerous RAT.exe

  • Size

    7.2MB

  • MD5

    302cb7218c3275c139ac070dae4f4daa

  • SHA1

    bcf24a42ae53f36863caa8b9c49a67d6a2bbc223

  • SHA256

    0079ba87b80bba1dbeb2fb1ea7361f7a44d0c4e9d55995c28b3329e9265a8c14

  • SHA512

    118819ac3011e0cb6222e883c95d179a970b8166dccdff7ed3bdeb34d1f67a5eee1ef2b251d708fd67b07835eb67cdbfcf877bb722f35a4dd086e38bf98c8adb

  • SSDEEP

    196608:/btBPRnfvon6IZYhydLLCdsflb8MKHTdas:7ZQ60LyS8MSas

Score
10/10
neshtaxwormadwarediscoverypersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Version

3.0

C2

3skr.uncofig.com:9999

Mutex

wRjQMjeNtaZnUCMU

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot7942324376:AAFz5Z-GdKIj1CePZyqIUmvNWOymMRw8Lmk/sendMessage?chat_id=2078478344

aes.plain

Signatures

  • Detect Neshta payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dangerous RAT.exe
    "C:\Users\Admin\AppData\Local\Temp\Dangerous RAT.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Local\Temp\set.exe
      "C:\Users\Admin\AppData\Local\Temp\set.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:760
    • C:\Users\Admin\AppData\Local\Temp\Dangerous RAT 2020 Cracked by Unknown Venom.exe
      "C:\Users\Admin\AppData\Local\Temp\Dangerous RAT 2020 Cracked by Unknown Venom.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 864
        3⤵
        • Program crash
        PID:3568
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
    1⤵
      PID:3828
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0Y5MjRGMzUtNkIxRi00QTUxLThFMjktOTFCN0VFNzEzOTBEfSIgdXNlcmlkPSJ7RENBQjczRTctNUI3Qi00RDUxLTkxOUItNTI5MzdDN0ZBMUJFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MjI0NzAwRUMtRjBDQi00RDE4LTg5MTQtOUVDMEU0RTYxNzMzfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRldGltZT0iMTczODk1NTgxNiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI4NDUyMDc3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxOTc5NDM3OTQiLz48L2FwcD48L3JlcXVlc3Q-
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2968
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\MicrosoftEdge_X64_133.0.3065.51.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\MicrosoftEdge_X64_133.0.3065.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\MicrosoftEdge_X64_133.0.3065.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3160
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.51 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ef7c6a68,0x7ff6ef7c6a74,0x7ff6ef7c6a80
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          PID:1508
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.51 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ef7c6a68,0x7ff6ef7c6a74,0x7ff6ef7c6a80
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1904
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4084
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.51 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7f36d6a68,0x7ff7f36d6a74,0x7ff7f36d6a80
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:3936
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4236
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.51 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7f36d6a68,0x7ff7f36d6a74,0x7ff7f36d6a80
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:4268
        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.54 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.51 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7f36d6a68,0x7ff7f36d6a74,0x7ff7f36d6a80
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{399108B8-B110-430C-9006-7F77DA0AC433}\EDGEMITMP_B2DFF.tmp\setup.exe
      Filesize

      6.8MB

      MD5

      9e8136a9be4d89a224ac072d28cae0c3

      SHA1

      4b73f200cbedd0db01b2b927829e0c72f2b77418

      SHA256

      60304a058775c7fdc4e656e018c4f977a3c61fb9630607b95ef504b408575264

      SHA512

      a9b28c4afd7bf5ced9179b2fd084b10eca971215295865564c86763500f16ab8ea99a58e8a4240e1faed113e573f27a60dd6696e42854aa58335b262cebe7c30

      Download Submit

    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      Filesize

      3.9MB

      MD5

      72d6c99b8786c8993a67620bf19fd130

      SHA1

      f59d8ea56b0ddb3c6d4fb84f593c2edeb1dc0e5f

      SHA256

      ed6cec9c8bf86b68424a037f359ca957c880295a8228f253c0b2c6623a058fa7

      SHA512

      91b414d56fe7960a6b55fdf3367d0004e9cec94a5da1ccfa363626993284ab4d03e2de756801b81ffbf72a18bd741c40514f4c4bb65e37cbedf4fcb928f1b362

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Dangerous RAT 2020 Cracked by Unknown Venom.exe
      Filesize

      11.2MB

      MD5

      fb40ba1b494af4057ab259bba5f33fe6

      SHA1

      b872393a07d3949947a41871132b736c00c771bb

      SHA256

      40a82c50b9875698551a2f6dd4f71fc23b4a04eeec655a4746111279ef57d2ac

      SHA512

      f2feec8be6578aa273efd363ae1eba0862fc240a441fd8d1f14942fda241e34896e7b76179d7132af97f18acdf13afd4032f1874a9b20cc04120706beff9e804

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\set.exe
      Filesize

      38KB

      MD5

      e1929d0781ff08abf8be3051479043b6

      SHA1

      0605a5657e022bd1cadf80f13446c678728dcde9

      SHA256

      b4ae6a462c5f24bec5870f6e92d94a00b1e1a4abd95e5433d6ac99a0f9d92042

      SHA512

      fb47c341b636293d500f1892f02e2be2b16bd0301eedc0c30025c00ae22ce3fe6d42abc0a4837cc5551eeed6cd5bbe815a0301db86bac6a84177a6c103d54d27

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      74KB

      MD5

      076c639bf92104c931cb8d7a1f566e5b

      SHA1

      48de6aae26aa2be6d9f7e4b3f7405c0d99afc040

      SHA256

      a5058773b15a068e7036a26d641f138c5078e48e612700142e4fe237b937ce9e

      SHA512

      c61de6bf1751ef41cb218b822fb9654e8ce780cbe970111e2ed08c021bf93ad5aae40619821b0a073aee76baa3acfe7b86e0a3b43dfab2e62f3d02633dc76b4e

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      100KB

      MD5

      d830aaf0388059adebc45c932c919de5

      SHA1

      f3d7d1b43cdcb5e888b1b1559a8515a7964e55b0

      SHA256

      b7fb6b85807799fb3b06df9af56289261fd6e3e58c3e5d74c869f24f82936264

      SHA512

      c613288a9f09d369c25cdd44d0d32a8a1ff705cf49658250b55d2ac41bc491f7b5806c565daa8bf27a475af3d7077e9f143fd8fb76fbb5a54049b5c07b2f041f

      Download Submit

    • C:\Windows\SystemTemp\msedge_installer.log
      Filesize

      106KB

      MD5

      999cab4cc1426a8f97b40cfad0fcde34

      SHA1

      803d59490e0709b99299f183cec3cbe711088d7e

      SHA256

      13c7d3f7514354688388facadf916c4cd85b9f0ffdf41b554dac38d9f856af88

      SHA512

      7fcba6140657adea31d791ae5899f9b65e89b7823f8593368d8aff0ec9c2c3ae35fab21cfb090d80d0d759da0044ee2d2afded20e3d43f743e299efea9508ff6

      Download Submit

    • memory/760-16-0x00007FFE9B4D0000-0x00007FFE9BF92000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/760-36-0x000000001B380000-0x000000001B390000-memory.dmp

      Filesize

      64KB

      Download

    • memory/760-37-0x00007FFE9B4D0000-0x00007FFE9BF92000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/760-15-0x0000000000590000-0x00000000005A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1400-32-0x00000000000E0000-0x0000000000C1E000-memory.dmp

      Filesize

      11.2MB

      Download

    • memory/1400-33-0x0000000005D00000-0x00000000062A6000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1400-34-0x0000000005660000-0x00000000056F2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/1400-35-0x0000000005800000-0x000000000589C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1400-30-0x00000000738CE000-0x00000000738CF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4956-31-0x00007FFE9B4D0000-0x00007FFE9BF92000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4956-0-0x00007FFE9B4D3000-0x00007FFE9B4D5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/4956-4-0x00007FFE9B4D0000-0x00007FFE9BF92000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4956-1-0x0000000000E00000-0x0000000001542000-memory.dmp

      Filesize

      7.3MB

      Download