Analysis
- max time kernel
92s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
13/07/2026, 14:28
General
- Target 888_RAT.exe
- Size 22.0MB
- Sample260713-rs2wpacy4y
- SHA256 27e3e3350715b83a2a3059c008517e1e97b2531557aaefd3b4cee38f62039b1c
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Disables one or more Microsoft Defender components 1 TTPs 5 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Drops startup file 3 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
- UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- NSIS installer 2 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\888_RAT.exe"C:\Users\Admin\AppData\Local\Temp\888_RAT.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\888_RAT_1.0.9 Cracked by Shark M!nd.exe"C:\Users\Admin\AppData\Local\Temp\888_RAT_1.0.9 Cracked by Shark M!nd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\majid z hacker website.exe"C:\Users\Admin\AppData\Local\Temp\majid z hacker website.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\program startup.exe"C:\Users\Admin\AppData\Local\Temp\program startup.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\FPJMCI.vbs4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\microsoft corporation.exe"C:\Users\Admin\AppData\Local\Temp\microsoft corporation.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\microsoft corporation.exe"C:\ProgramData\microsoft corporation.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\ProgramData\microsoft corporation.exe" "microsoft corporation.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\SysWOW64\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs" /elevate4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBehaviorMonitoring $true5⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true5⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true5⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true5⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 25⤵
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 05⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 65⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 65⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 65⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\ProgramData\microsoft corporation.exe"C:\ProgramData\microsoft corporation.exe" ..1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Windata\program startup.exe"C:\Users\Admin\AppData\Roaming\Windata\program startup.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
888_RAT_1.0.9 Cracked by Shark M!nd.exe
FPJMCI.vbs
Splash8.jpg
__PSScriptPolicyTest_zfqyws4v.kq2.ps1
autAE9F.tmp
majid z hacker website.exe
microsoft corporation.exe
program startup.exe
script.vbs
skin.888ww.msstyles
memory/332-178-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/764-221-0x0000000006F90000-0x0000000007026000-memory.dmp
memory/764-169-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/1044-224-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/1136-233-0x0000000007740000-0x000000000775A000-memory.dmp
memory/1136-234-0x0000000007730000-0x0000000007738000-memory.dmp
memory/1136-190-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/1136-232-0x0000000007640000-0x0000000007655000-memory.dmp
memory/1136-231-0x0000000007630000-0x000000000763E000-memory.dmp
memory/1136-223-0x00000000075E0000-0x00000000075F1000-memory.dmp
memory/1492-214-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/2500-207-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/2504-162-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/2504-63-0x00000000053B0000-0x00000000059DA000-memory.dmp
memory/2504-66-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/2504-65-0x0000000005C10000-0x0000000005C76000-memory.dmp
memory/2504-64-0x0000000005310000-0x0000000005332000-memory.dmp
memory/2504-67-0x0000000005CF0000-0x0000000006047000-memory.dmp
memory/2752-160-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/2752-36-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/2752-222-0x0000000000400000-0x00000000004CA000-memory.dmp
memory/3908-144-0x0000000007360000-0x0000000007394000-memory.dmp
memory/3908-145-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/3908-197-0x00000000074E0000-0x00000000074FA000-memory.dmp
memory/3908-62-0x00000000029D0000-0x0000000002A06000-memory.dmp
memory/3908-206-0x0000000007550000-0x000000000755A000-memory.dmp
memory/3924-199-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/4196-159-0x0000000006E00000-0x0000000006E1E000-memory.dmp
memory/4196-135-0x0000000006010000-0x000000000605C000-memory.dmp
memory/4196-134-0x0000000005E10000-0x0000000005E2E000-memory.dmp
memory/4196-152-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/4196-198-0x00000000077A0000-0x0000000007E1A000-memory.dmp
memory/4196-161-0x0000000007020000-0x00000000070C4000-memory.dmp
memory/4956-176-0x00000000716E0000-0x000000007172C000-memory.dmp
memory/5028-362-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-328-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-306-0x0000000075600000-0x0000000075625000-memory.dmp
memory/5028-305-0x00000000762A0000-0x000000007631C000-memory.dmp
memory/5028-308-0x0000000075600000-0x0000000075625000-memory.dmp
memory/5028-309-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-344-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-291-0x0000000010000000-0x00000000100BB000-memory.dmp
memory/5028-359-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-357-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-356-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-355-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-354-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-351-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-350-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-349-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-341-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-334-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-329-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-320-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-352-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-348-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-347-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-346-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-345-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-342-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-340-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-339-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-337-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-336-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-335-0x00000000761C0000-0x000000007629F000-memory.dmp
memory/5028-331-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-330-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-297-0x00000000762A0000-0x000000007631C000-memory.dmp
memory/5028-327-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-326-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-325-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-324-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-323-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-322-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-321-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-319-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-313-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-316-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-343-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-332-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-338-0x0000000075E90000-0x0000000075FDD000-memory.dmp
memory/5028-333-0x0000000075430000-0x00000000754B2000-memory.dmp
memory/5028-296-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-315-0x0000000077790000-0x000000007784F000-memory.dmp
memory/5028-312-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-311-0x0000000075E90000-0x0000000075FDD000-memory.dmp
memory/5028-310-0x0000000076DF0000-0x00000000773F2000-memory.dmp
memory/5028-307-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-301-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-318-0x0000000073E80000-0x00000000740A3000-memory.dmp
memory/5028-317-0x0000000075E90000-0x0000000075FDD000-memory.dmp
memory/5028-314-0x00000000761C0000-0x000000007629F000-memory.dmp
memory/5028-304-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-298-0x0000000000C00000-0x0000000002207000-memory.dmp
memory/5028-303-0x0000000075600000-0x0000000075625000-memory.dmp
memory/5028-300-0x00000000762A0000-0x000000007631C000-memory.dmp
memory/5028-299-0x00000000762A0000-0x000000007631C000-memory.dmp
memory/5028-302-0x00000000762A0000-0x000000007631C000-memory.dmp
memory/5028-475-0x0000000010000000-0x00000000100BB000-memory.dmp
memory/5028-386-0x0000000010000000-0x00000000100BB000-memory.dmp
memory/5316-264-0x0000000000400000-0x00000000004CA000-memory.dmp