runningrat | 6d588fdd67f611a907005b0236d324acbf152298a6e28f5d97f9d23001d4d5e8

General

Target
2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
Size 56KB
Sample260107-e1mqhsfl4w
SHA256 6d588fdd67f611a907005b0236d324acbf152298a6e28f5d97f9d23001d4d5e8
MD5 ab193c0efce055a896b1ebecdf4a6033
SHA1 97044be49f740a5f301d951a9d2166a1a39c1bda
SHA512 673ab9c8b05d72845b215c93934e20ef9a3cfa4562d48f7f5cc36140acd004a072bf0ee10950548d85ccb70a6b478058db1e2a4f88d3a33f5095e4f5e911fe6b
SSDEEP 768:Dr0atvvxN9tpdC7EezJ0d8hPUtrFRtFtg3NojiwvuccA4iiKahtAZchL:Dr0udk7ESuqhParNMKnFfiroZch
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery runningrat persistence rat

Malware Config

Signatures

RunningRat
RunningRat is a remote access trojan first seen in 2018.
rat runningrat
Runningrat family
runningrat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\svhast\Parameters\ServiceDll = "C:\\Windows\\system32\\240625687.dll"	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Executes dropped EXE 1 IoCs

pid	Process
5056	svhast.exe

Loads dropped DLL 3 IoCs

pid	Process
4912	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
4284	svchost.exe
5056	svhast.exe

Creates a Windows Service
persistence

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\240625687.dll	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
File created	C:\Windows\SysWOW64\svhast.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svhast.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhast.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2600	cmd.exe
5076	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svhast.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svhast.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svhast.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svhast.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svhast.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svhast.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svhast.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5076	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4912	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
4912	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4912	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4912	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2600	4912	2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe	79
PID 2600 wrote to memory of 5076	2600	cmd.exe	81
PID 4284 wrote to memory of 5056	4284	svchost.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe
"C:\Users\Admin\AppData\Local\Temp\2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\2026-01-07_ab193c0efce055a896b1ebecdf4a6033_elex_runningrat_wannacry_zxshell.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5076

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svhast"
1⤵
PID:3160

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svhast"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\svhast.exe
  C:\Windows\system32\svhast.exe "c:\windows\system32\240625687.dll",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:5056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k "svhast"
1⤵
PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

240625687.dll

Path C:\Windows\SysWOW64\240625687.dll
Size 33KB
SHA256 d12f0cb3d1ecc150051741ff4123946bbffa7c2495ccf9ff783589e9b32f90e9
MD5 f1bbb4e5cf0353481bf7e522ed5bba09
SHA1 c3e0e7530172ef68a0b516f94bd590821da3df4a
SHA512 c7776f6c316f9a4b85a703194c343ba54f1f701f97df30ef422875414cb5a01cc74b33a7511ebb042f633bdb82c6bada52841577fe8900f4057df3a77bc7a17f
SSDEEP 384:IEwQJ4+4AAf3IOI6PtW1q/pXM+RfW1YQN+sXPFZVGJ2ZBp7am56H8x9l0aALlsHN:IPQJ4+4L4h6cYRfUYcb/FOMsmT9WXst
MD5 SHA1 SHA512 SSDEEP

Submit Download

svhast.exe

Path C:\Windows\SysWOW64\svhast.exe
Size 40KB
SHA256 8dcaeeebef9b9f3d41d295db145ffb3850f309d089c08125c7fa7034db5fd80e
MD5 22bb5bd901d8b25ac5b41edbb7d5053e
SHA1 8a935dd8d7e104fc553ff7e8b54a404f7b079334
SHA512 cc3fb68fd6791a08e4a7d1a8db8d07cfcc8c9b9dceec10b53f0cb7ee86473303a19be4f23e379f84c59e02d0568e7c066e21cd1300f6032dac4ba52f609f62e7
SSDEEP 768:C67uhQpPPp0nnqFk509FRdVcQX6N58hJYim1jLP3RRe:C67uhQpXp0nnqa5093jKNAmB3RR
MD5 SHA1 SHA512 SSDEEP