ratonrat | 7ca81f09331d8b26822ecfb8d423f04b4178875b1b50269e6e2c01e4d69ca006

General

Target
Crypted.exe
Size 9.1MB
Sample260602-k187eahv51
SHA256 7ca81f09331d8b26822ecfb8d423f04b4178875b1b50269e6e2c01e4d69ca006
MD5 79d7da380cee317fcb88e86adc978495
SHA1 247c2d17394c95e428f313500a1384009b2f59a1
SHA512 e1a65cac8e8051decfaa84032ef49109db638fef91c7d637b5b4179a8c74e714d82af97d876fb667183a22ff508390a7dc801d8bcc9530d82be91af2e250e90c
SSDEEP 24576:jCIqGd38wawlgJEpexcfq2uR4PGgzqcr1DwOY2vYlUIupDAVqhaYjrxVbyx9eEHf:j7MyMcy4JBSUqVcjVWJX
TLSH
T19AA6BFB4B9046CF6EA2F0277C996A9EE13751A128F97D9CBC0647BC709B3371ED12805
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion discovery execution ratonrat packer persistence stealer

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

C2

tcp.cloudpub.ru:38193

Mutex

Ik0Q1cl0WjLCVPSof6omtkN

Attributes

assist
true
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
3
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Loh
uac
true
vm
true
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000025ad8-2.dat	family_ratonrat
behavioral2/memory/5276-4-0x0000016A211D0000-0x0000016A2155C000-memory.dmp	family_ratonrat

Executes dropped EXE 3 IoCs

pid	Process
5276	spoolsv_svc.exe
3192	spoolsv_svc.exe
4536	spoolsv_svc.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x0009000000025ad8-2.dat	costura

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypted.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5484	timeout.exe
5112	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5152	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	spoolsv_svc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 5276	5056	Crypted.exe	80
PID 5276 wrote to memory of 4420	5276	spoolsv_svc.exe	81
PID 4420 wrote to memory of 5792	4420	cmd.exe	83
PID 4420 wrote to memory of 5484	4420	cmd.exe	84
PID 4420 wrote to memory of 3192	4420	cmd.exe	85
PID 4420 wrote to memory of 5112	4420	cmd.exe	86
PID 3192 wrote to memory of 5152	3192	spoolsv_svc.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Crypted.exe
"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\spoolsv_svc.exe
  C:\Users\Admin\AppData\Local\Temp\spoolsv_svc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\cleanup_ZQ3POo5kswajtWliShbUvJ5D8v2hU5.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5792
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5484
  - - C:\Users\Admin\AppData\Roaming\PlatformRuntime\spoolsv_svc.exe
      "C:\Users\Admin\AppData\Roaming\PlatformRuntime\spoolsv_svc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "spoolsv_svc" /sc ONLOGON /tr "\"C:\Users\Admin\AppData\Roaming\PlatformRuntime\spoolsv_svc.exe\"" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5152
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5112

C:\Users\Admin\AppData\Roaming\PlatformRuntime\spoolsv_svc.exe
"C:\Users\Admin\AppData\Roaming\PlatformRuntime\spoolsv_svc.exe"
1⤵
- Executes dropped EXE
PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoolsv_svc.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spoolsv_svc.exe.log
Size 859B
SHA256 a6f7d3892a001df1aafe2eaf221a3b09a4fdad23ad642a62b9cc50fd25f9415f
MD5 b80ab36515c0740685e38a5cd01e292a
SHA1 ebea40ce14021888f2c869576ad62b98b7c73c8a
SHA512 a9ad31c000c2264f8a9b7bac6bc60edd7ecf0d1c946a4bb3e57d824283c6b65e59344e834bcbf563586211078ddb895af13e4c697bea2c4a907982bbc5fbd4a0
TLSH
T1CE1166313376A0D889163F821C1E56C957BF4329A550AD08B998624DED3601B6B213E3
MD5 SHA1 SHA512 TLSH

Submit Download

spoolsv_svc.exe

Path C:\Users\Admin\AppData\Local\Temp\spoolsv_svc.exe
Size 3.5MB
SHA256 1759d76d7d3cbd570cb548437370f2d099dcb0c5d76b73e9fba587d9381084a4
MD5 f23207338277111e3d034632e65ba429
SHA1 c19fe06e57bd96cb56b1df6d489f7cc8662423ad
SHA512 d8aad6fc37bc1c1c71ddc93f27f696b26458f8dbdd81b26ddf0abc3acb1144bdbbaf3c80c015dfa450433c186a1522d85ca8e1d819444e4b60434d841e6d8dfc
SSDEEP 49152:Gmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sQ:Lq0WgVUuHjkDGjYQeqpgmltQ
TLSH
T15806CF407BD4CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cleanup_ZQ3POo5kswajtWliShbUvJ5D8v2hU5.bat

Path C:\Users\Admin\AppData\Roaming\Temp\cleanup_ZQ3POo5kswajtWliShbUvJ5D8v2hU5.bat
Size 546B
SHA256 8345998709de0536cbafb46e83b56db810fa868230af8192f86551a0e4200a27
MD5 aa649af7f84d516a3be5e5f830ab4f9e
SHA1 7f4139535f96f8169408c2ff3b881294e4c67b54
SHA512 a433c8e36292b5016ea890f5f25d05c5f06b7fe564d8f4defe88a0c31ea66fc42041e06a6a611bee48774faeb88a0cabb6f2c4bdbe1547c7bfbf0db06081354f
TLSH
T1E8F0591222DF839A281161770EB7308CD1D548577F8575613F28C41A279B41BBAC77C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5276-4-0x0000016A211D0000-0x0000016A2155C000-memory.dmp

Download

memory/5276-5-0x0000016A3D290000-0x0000016A3D2A0000-memory.dmp

Download

memory/5276-6-0x0000016A21980000-0x0000016A21988000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads