runningrat | 6d588fdd67f611a907005b0236d324acbf152298a6e28f5d97f9d23001d4d5e8

General

Target
2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
Size 56KB
Sample260107-e1mqhsfl4w
SHA256 6d588fdd67f611a907005b0236d324acbf152298a6e28f5d97f9d23001d4d5e8
MD5 ab193c0efce055a896b1ebecdf4a6033
SHA1 97044be49f740a5f301d951a9d2166a1a39c1bda
SHA512 673ab9c8b05d72845b215c93934e20ef9a3cfa4562d48f7f5cc36140acd004a072bf0ee10950548d85ccb70a6b478058db1e2a4f88d3a33f5095e4f5e911fe6b
SSDEEP 768:Dr0atvvxN9tpdC7EezJ0d8hPUtrFRtFtg3NojiwvuccA4iiKahtAZchL:Dr0udk7ESuqhParNMKnFfiroZch
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery runningrat persistence rat

Malware Config

Signatures

RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat
Runningrat family
runningrat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svhast\Parameters\ServiceDll = "C:\\Windows\\system32\\240624218.dll"	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-338284474-3467125431-3954861403-1000\Control Panel\International\Geo\Nation	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Executes dropped EXE 1 IoCs

pid	Process
2796	svhast.exe

Loads dropped DLL 3 IoCs

pid	Process
3616	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
764	svchost.exe
2796	svhast.exe

Creates a Windows Service
persistence

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240624218.dll	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
File created	C:\Windows\SysWOW64\svhast.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svhast.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhast.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2036	cmd.exe
4700	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svhast.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svhast.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svhast.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svhast.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svhast.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svhast.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svhast.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4700	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3616	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
3616	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3616	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3616	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2036	3616	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe	90
PID 2036 wrote to memory of 4700	2036	cmd.exe	92
PID 764 wrote to memory of 2796	764	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
"C:\Users\Admin\AppData\Local\Temp\2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4700

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svhast"
1⤵
PID:1980

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svhast"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\SysWOW64\svhast.exe
  C:\Windows\system32\svhast.exe "c:\windows\system32\240624218.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:2796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svhast"
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240624218.dll

Path C:\Windows\SysWOW64\240624218.dll
Size 33KB
SHA256 d12f0cb3d1ecc150051741ff4123946bbffa7c2495ccf9ff783589e9b32f90e9
MD5 f1bbb4e5cf0353481bf7e522ed5bba09
SHA1 c3e0e7530172ef68a0b516f94bd590821da3df4a
SHA512 c7776f6c316f9a4b85a703194c343ba54f1f701f97df30ef422875414cb5a01cc74b33a7511ebb042f633bdb82c6bada52841577fe8900f4057df3a77bc7a17f
SSDEEP 384:IEwQJ4+4AAf3IOI6PtW1q/pXM+RfW1YQN+sXPFZVGJ2ZBp7am56H8x9l0aALlsHN:IPQJ4+4L4h6cYRfUYcb/FOMsmT9WXst
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhast.exe

Path C:\Windows\SysWOW64\svhast.exe
Size 60KB
SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
MD5 889b99c52a60dd49227c5e485a016679
SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads