Analysis
- geolocation tags
cacanadananorth-americatoronto - user interaction
yes - max time kernel
91s - max time network
67s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 23:52
General
- Target BoRat Rat.7z
- Size 8.6MB
- Sample260620-3w5yasbt21
- SHA256 758da04589faf3a8aedeae4f9e26c90c4a7530f5e8368a368efe8ef792f167d9
- MD5 320967ea4c3f77c31cf5b8a7c7281db1
- SHA1 4604180a62e0c5e8df87b9713213551aef8f911d
- SHA512 7e6f5d8f98d38aa2ddbd26c9eee10492d01f42f822139f227b85ef4807503522375e07c83f3ddf98cdda228061041a972bed77f412cece8338360cabae5ea2bd
- SSDEEP 196608:MadsOFP+sWfx5xbDe5OK2bMQy/dc7FzuU4MO0KJN+0Dvo+l:/Gt5TbaN8MQy/dcgMO0t6P
- TLSH T16B9633DF16B825B573621FFD763F45A450938A0B2F78B8840EC90461A7396E9CAF811F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects BoratRAT RAT 2 IoCs
resource yara_rule behavioral1/files/0x0007000000024383-51.dat family_boratrat_net behavioral1/memory/3480-53-0x000002CABA600000-0x000002CABBA06000-memory.dmp family_boratrat_net - Executes dropped EXE 1 IoCs
pid Process 3480 BoratRat_Cracked.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 3480 BoratRat_Cracked.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 544 7zFM.exe 3480 BoratRat_Cracked.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 544 7zFM.exe Token: 35 544 7zFM.exe Token: SeSecurityPrivilege 544 7zFM.exe Token: SeDebugPrivilege 3480 BoratRat_Cracked.exe Token: SeDebugPrivilege 1640 taskmgr.exe Token: SeSystemProfilePrivilege 1640 taskmgr.exe Token: SeCreateGlobalPrivilege 1640 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 544 7zFM.exe 544 7zFM.exe 3480 BoratRat_Cracked.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 3480 BoratRat_Cracked.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe - Suspicious use of SendNotifyMessage 63 IoCs
pid Process 3480 BoratRat_Cracked.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe 1640 taskmgr.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\BoRat Rat.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:544
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3480
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1072
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe
- Size 20.0MB
- SHA256 9e7e71f470c44d253d72a78f1ccdde34b4a0bff6242d86006cd6e364b6bbf79c
- MD5 c68cf8d1c438a9c59878deb36d17e197
- SHA1 fc6158fbab2762f1da42c7a486fd04bd8b547f05
- SHA512 67bad918bf1b4d1d1461ae949c7ef9e953fe447df46e7d32484914ef74cc658d8746b5bb2fb354f8c07fb961d9e4b395e7c2dab4e49e6b26d0af51aad5b27ccf
- SSDEEP 393216:nm2XTCP+Zw6NLIsFfskh1BmXGnfBd+Ly:nmmTCP+Zlnk0rmkBYLy
- TLSH T16E27D000FAE4CA56D07A9AF5D0B306759BB0AD19E72287BB1180BB5D3EF37447816327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe.config
- Size 5KB
- SHA256 f29e697efd7c5ecb928c0310ea832325bf6518786c8e1585e1b85cdc8701602f
- MD5 3e645ccca1c44a00210924a3b0780955
- SHA1 5d8e8115489ac505c1d10fdd64e494e512dba793
- SHA512 ea7e3a6e476345870f05124a56dde266e1ad04b557b2dde83c5674cfdf3be00f26d3db6a14a8d88ecf75e2c9e3a12e6955f6c85654ba967c17664e9acc3d4f1f
- SSDEEP 96:Xr7T7Kc7KnreNRrqAbGxRN3ZV/Kw4YpyMasJ8J4YqJyM/:Xr7T7D7or8E3ZV/Kw/pvasJ8J/qJv/
- TLSH T127B1E758B1F5CEAA014A2A32EB305285DEE006631275B4F8B8FD21555F51CCB8BB37F9
- MD5 SHA1 SHA512 SSDEEP TLSH