milleniumrat | db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Update.exe
Size 5.6MB
Sample260724-epcfea1wcs
SHA256 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2
MD5 731812403191b60503e017d88e23b1a3
SHA1 67e1c24ded75620181916dea9654eeddf4049525
SHA512 1ae78e7d5e134d56ebbe9ec3e71bd7529aedbe5670a93b7728eca0aa482ac6688187884c5a61c2c8ef308acda555152d4d5cd2938d1cfa57303a8649803f01d5
SSDEEP 98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6m:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciK
TLSH
T1B646F116F6D500D8E9E7417882BB6B67EA7070011320ABDB53D049B96F23BD27A7F319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion discovery execution milleniumrat packer persistence rat stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/3524-1-0x000002919BB90000-0x000002919C130000-memory.dmp	family_milleniumrat
behavioral2/files/0x000d00000001c43e-23.dat	family_milleniumrat

Executes dropped EXE 2 IoCs

pid	Process
1448	Update.exe
3208	Update.exe

Loads dropped DLL 3 IoCs

pid	Process
3524	Update.exe
1448	Update.exe
3208	Update.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleChromeUpdateLog\\Update.exe"	reg.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com
11	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5668	tasklist.exe
2208	tasklist.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/files/0x000d00000001c43e-23.dat	costura

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4260	cmd.exe
3984	cmd.exe
2224	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2036	timeout.exe
1452	timeout.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4448	reg.exe
4476	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
3524	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe
1448	Update.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3524	Update.exe
Token: SeDebugPrivilege	5668	tasklist.exe
Token: SeDebugPrivilege	2208	tasklist.exe
Token: SeDebugPrivilege	1448	Update.exe
Token: SeDebugPrivilege	3208	Update.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1448	Update.exe
3208	Update.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4260	3524	Update.exe	90
PID 4260 wrote to memory of 5668	4260	cmd.exe	92
PID 4260 wrote to memory of 3272	4260	cmd.exe	93
PID 4260 wrote to memory of 2036	4260	cmd.exe	94
PID 4260 wrote to memory of 2208	4260	cmd.exe	95
PID 4260 wrote to memory of 2304	4260	cmd.exe	96
PID 4260 wrote to memory of 1452	4260	cmd.exe	97
PID 4260 wrote to memory of 1448	4260	cmd.exe	98
PID 1448 wrote to memory of 3984	1448	Update.exe	100
PID 3984 wrote to memory of 4448	3984	cmd.exe	102
PID 3208 wrote to memory of 2224	3208	Update.exe	108
PID 2224 wrote to memory of 4476	2224	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\Update.exe
"C:\Users\Admin\AppData\Local\Temp\Update.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp12C3.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp12C3.tmp.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3524"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:3272
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2036
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 3524"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:2304
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1452
- - C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
    "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4448

C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlite.interop.dll

Path C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
Size 1.7MB
SHA256 aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
MD5 65ccd6ecb99899083d43f7c24eb8f869
SHA1 27037a9470cc5ed177c0b6688495f3a51996a023
SHA512 533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
SSDEEP 49152:c9EeNSPwEW3cFSI4Tfm3hvbHsjAJcAMkP3:c9Nzm31PMo3
TLSH
T1B9858D4BB2B8009CD5A7C17DC617670BEBB174051750ABDB17A087AA2F23FE516BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp12C3.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp12C3.tmp.bat
Size 256B
SHA256 cca83f82a06aecf2374931ff1b0fd8cc501e753d91bfcc45dc68973ada463841
MD5 66b86989ed61f9d957d9eab49471071b
SHA1 baa8d391bcb1c8e1506ee69b1cf6e0ec2e235630
SHA512 180f98d88e62f0e897e99116d65d2c5bc07c032ec9a97c99b4c7692aaf5c7065272366b926bb80edef847d8c5acd9f0d5062cbf6eacf1be8d21a3076af3f10ba
TLSH
T129D05E6311C8CB2F542198BB9B39B488A9F54A51ED1A394A5B10996A138C812BE8E182
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
Size 5.6MB
SHA256 db874ae685d2bc4235b1213ec9d43d327c8d2bd12300bb0d78c9ce0a84c828b2
MD5 731812403191b60503e017d88e23b1a3
SHA1 67e1c24ded75620181916dea9654eeddf4049525
SHA512 1ae78e7d5e134d56ebbe9ec3e71bd7529aedbe5670a93b7728eca0aa482ac6688187884c5a61c2c8ef308acda555152d4d5cd2938d1cfa57303a8649803f01d5
SSDEEP 98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6m:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciK
TLSH
T1B646F116F6D500D8E9E7417882BB6B67EA7070011320ABDB53D049B96F23BD27A7F319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3524-13-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-15-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-8-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-9-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-10-0x000002919DF00000-0x000002919DF1E000-memory.dmp

Download

memory/3524-11-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-12-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-0-0x00007FF814EAF000-0x00007FF814EB0000-memory.dmp

Download

memory/3524-14-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-7-0x00000291B66C0000-0x00000291B6736000-memory.dmp

Download

memory/3524-16-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-17-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-18-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-19-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-21-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-2-0x00007FF814D20000-0x00007FF8156C4000-memory.dmp

Download

memory/3524-1-0x000002919BB90000-0x000002919C130000-memory.dmp

Download