Resubmissions

20/03/2025, 08:31 UTC

250320-ke41kaysct 10

19/03/2025, 18:31 UTC

250319-w6aftazxav 7

Analysis

  • max time kernel
    221s
  • max time network
    298s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-de
  • resource tags

    arch:x64arch:x86image:win11-20250314-delocale:de-deos:windows11-21h2-x64systemwindows
  • submitted
    20/03/2025, 08:31 UTC

General

  • Target

    888 Rat v1.2.6.exe

  • Size

    75.0MB

  • MD5

    ad33064a9ca95c5b3ed45c14b7fe2739

  • SHA1

    0bd1286fa5fd936a31a4514798daffa444ce8e12

  • SHA256

    5a14099abd6fe4b396094db7f9911251b25cd57893e14f97a7e7c5f44337bc98

  • SHA512

    acb056e217edef4639179b24193a454f7e5aade51c1cc972e0458fc23c0ad982323161ad37050a4d849641dbf84719707efdcf4c99ecdf413381e5a752413647

  • SSDEEP

    1572864:5mhnD+9mK/LnkHD1LYrXatfLllR3RboTmxXlIgU/cNruKPZiv:6nD+UozkJLYrXajR4ElIgU/c5Qv

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 4 IoCs
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe
    "C:\Users\Admin\AppData\Local\Temp\888 Rat v1.2.6.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Splash8.jpg

    Filesize

    32KB

    MD5

    a3083356947cdfb053c7c63cec79e85f

    SHA1

    81d71adf137d5a8dff56843250578bb68333ba9a

    SHA256

    3e290e256bf19f56b233c42f19397807a83bde6cc792d6ea2f6c615cfc92ec1d

    SHA512

    820ac1ca3472f2356c7ad3c7443a431eea3f710679e6467f47ee8918e7c206767ff99401ced14dd3d012d930b1aad3225b9f9e1a7a9ee4303a8b204f05fdf766

  • C:\Users\Admin\AppData\Local\Temp\aut6D75.tmp

    Filesize

    239KB

    MD5

    29e1d5770184bf45139084bced50d306

    SHA1

    76c953cd86b013c3113f8495b656bd721be55e76

    SHA256

    794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307

    SHA512

    7cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8

  • C:\Users\Admin\AppData\Local\Temp\skin.888ww.msstyles

    Filesize

    3.3MB

    MD5

    ea5d5266b8a7bcc8788c83ebb7c8c7d5

    SHA1

    3e9ac1ab7d5d54db9b3d141e82916513e572b415

    SHA256

    91ac4d215b8d90aef9a000900c9088d4c33d58c5f35a720a385a3f2d2299e5d1

    SHA512

    404b35fca478a1f489ec1af7be1df897190d7deb0cd8139c2c89d68c24fa377d904cf0c5e30c09ab448d74d87a47aaa3a872bf66a9bc9c124f52798320d34e60

  • memory/4464-44-0x000000000DCA0000-0x000000000DD5B000-memory.dmp

    Filesize

    748KB

  • memory/4464-55-0x0000000074F00000-0x0000000074F7C000-memory.dmp

    Filesize

    496KB

  • memory/4464-54-0x0000000074F00000-0x0000000074F7C000-memory.dmp

    Filesize

    496KB

  • memory/4464-50-0x000000000DCA0000-0x000000000DD5B000-memory.dmp

    Filesize

    748KB

  • memory/4464-57-0x0000000074F00000-0x0000000074F7C000-memory.dmp

    Filesize

    496KB

  • memory/4464-52-0x0000000074F00000-0x0000000074F7C000-memory.dmp

    Filesize

    496KB

  • memory/4464-58-0x00000000754B0000-0x00000000754D5000-memory.dmp

    Filesize

    148KB

  • memory/4464-56-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-53-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-61-0x00000000754B0000-0x00000000754D5000-memory.dmp

    Filesize

    148KB

  • memory/4464-63-0x00000000754B0000-0x00000000754D5000-memory.dmp

    Filesize

    148KB

  • memory/4464-60-0x0000000074F00000-0x0000000074F7C000-memory.dmp

    Filesize

    496KB

  • memory/4464-51-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-65-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-66-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-64-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-67-0x0000000074CC0000-0x0000000074E0D000-memory.dmp

    Filesize

    1.3MB

  • memory/4464-59-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-73-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-74-0x0000000074CC0000-0x0000000074E0D000-memory.dmp

    Filesize

    1.3MB

  • memory/4464-72-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-62-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-76-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-69-0x0000000075200000-0x00000000752DF000-memory.dmp

    Filesize

    892KB

  • memory/4464-71-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-70-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-79-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-82-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-81-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-80-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-68-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-78-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-77-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-83-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-87-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-88-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-75-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-92-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-95-0x0000000074CC0000-0x0000000074E0D000-memory.dmp

    Filesize

    1.3MB

  • memory/4464-93-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-91-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-84-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-94-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-90-0x0000000075200000-0x00000000752DF000-memory.dmp

    Filesize

    892KB

  • memory/4464-86-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-85-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-89-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-99-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-98-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-107-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-106-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-105-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-110-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-111-0x0000000074410000-0x0000000074492000-memory.dmp

    Filesize

    520KB

  • memory/4464-112-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-96-0x00000000006D0000-0x00000000051CD000-memory.dmp

    Filesize

    75.0MB

  • memory/4464-116-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-115-0x00000000756E0000-0x000000007579F000-memory.dmp

    Filesize

    764KB

  • memory/4464-114-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-109-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-103-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-102-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-104-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-101-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-100-0x0000000075AC0000-0x00000000760C2000-memory.dmp

    Filesize

    6.0MB

  • memory/4464-97-0x00000000749A0000-0x0000000074BC3000-memory.dmp

    Filesize

    2.1MB

  • memory/4464-135-0x000000000DCA0000-0x000000000DD5B000-memory.dmp

    Filesize

    748KB

  • memory/4464-215-0x000000000DCA0000-0x000000000DD5B000-memory.dmp

    Filesize

    748KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.