rat[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rat.exe
Size 422KB
Sample260624-twprmsdx3k
SHA256 d4729c23995416dbc597bcde029e59d6b7d0bc939a25312cfb092bb987024f62
MD5 c51119e6d6dc5f62ac185af151cad02a
SHA1 61ca471240a3019722f520cba1f9d70a4a488d60
SHA512 ecb95b713b5e4a4338fe99e6a0e20c1a84406cff0423a7e59ab24b9900ff53c79525f10e24620ac5ffa62235a3d71216f8785f6994bf1ac741dfcf5e4323204b
SSDEEP 6144:4WFrOOHPH5WezBTov/mgT+u38Njtb5/h5tcZX1gJnUXuV:9a0H1wkNB9/DmX2RU
TLSH
T1AD945C16979405FCE0B79279CE968D41EB35780A03E1EADF079485B21E676E08F3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 422KB

rat.exe

IMPHASH eb1a7e8c778e75426a4f6695df64e0f4
SHA256 d4729c23995416dbc597bcde029e59d6b7d0bc939a25312cfb092bb987024f62
MD5 c51119e6d6dc5f62ac185af151cad02a
SHA1 61ca471240a3019722f520cba1f9d70a4a488d60
SHA512 ecb95b713b5e4a4338fe99e6a0e20c1a84406cff0423a7e59ab24b9900ff53c79525f10e24620ac5ffa62235a3d71216f8785f6994bf1ac741dfcf5e4323204b
SSDEEP 6144:4WFrOOHPH5WezBTov/mgT+u38Njtb5/h5tcZX1gJnUXuV:9a0H1wkNB9/DmX2RU
TLSH
T1AD945C16979405FCE0B79279CE968D41EB35780A03E1EADF079485B21E676E08F3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

161140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostMessageW DefWindowProcW PostQuitMessage RegisterClassExW CreateWindowExW SwapMouseButton ExitWindowsEx IsWindow DestroyWindow ShowWindow GetDlgItem GetDlgItemTextW OpenClipboard CloseClipboard SetClipboardData SendMessageW TranslateMessage DispatchMessageW GetClipboardData EmptyClipboard SetFocus GetKeyState GetAsyncKeyState BlockInput SendInput GetSystemMetrics DrawTextW GetDC ReleaseDC BeginPaint EndPaint GetClientRect MessageBoxW ShowCursor FillRect SetRect GetWindowLongPtrW FindWindowW LockWorkStation GetMessageW EnumDisplayMonitors SystemParametersInfoW IsDialogMessageW LoadIconW LoadCursorW CallNextHookEx SetWindowsHookExW

gdi32

CreateCompatibleBitmap DeleteDC CreateCompatibleDC GetObjectA SetTextColor SetBkMode SelectObject GetStockObject GetDIBits DeleteObject CreateFontW CreateSolidBrush BitBlt

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

ws2_32

gethostname freeaddrinfo inet_ntop WSACleanup getaddrinfo WSAStartup ntohs

shell32

Shell_NotifyIconW ShellExecuteW

advapi32

OpenProcessToken LookupPrivilegeValueW GetUserNameW InitiateShutdownW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyExW RegCreateKeyExW RegCloseKey AdjustTokenPrivileges

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

winmm

mciSendStringW waveOutSetVolume

iphlpapi

GetExtendedTcpTable

powrprof

SetSuspendState

gdiplus

GdipSaveImageToStream GdipGetImageEncoders GdipCloneImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipDisposeImage

kernel32

VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW SetEndOfFile WaitForSingleObject GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetDriveTypeW ReadFile RemoveDirectoryW GetTempPathW CloseHandle GetLastError CreatePipe InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent RtlUnwind CreateEventW Sleep GetCurrentProcess ExitProcess TerminateProcess CreateThread CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetLocalTime GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThreadId InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx

Name

.text

Size

300KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

rat.exe

user32

gdi32

winhttp

ws2_32

shell32

advapi32

ole32

winmm

iphlpapi

powrprof

gdiplus

kernel32

generic