Overview

overview

10

Static

static

10

zenon brow...er.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    zenon browser installer.exe
  • Size 2.7MB
  • Sample260812-2l36aawejf
  • SHA256 d605d976bc874a56347f57472adcd2db513afe5b84aa4e9dd9c65614e4932e15
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ratonratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

  • ratonrat

Version

  • Professional

C2

  • jaydendestoyer101-44157.portmap.host:44157

Mutex

  • QFYb250i2jAwaYkWMVkb84A

Attributes
  • assist

    false

  • box

    true

  • box_icon

    Error

  • box_msg

    this is now our pc

  • box_title

    yo gng

  • defender

    true

  • delay

    0

  • hide_file

    true

  • open_website

    false

  • password

    t.me/junk_code

  • process_critical

    true

  • raw

    https://pastebin.com/raw/k5PcpeFy

  • reconnect

    3

  • startup

    true

  • tag

    Infected

  • uac

    false

  • vm

    false

  • website

    https://t.me/example

Targets

    • Target
      zenon browser installer.exe
    • Size 2.7MB
    • SHA256 d605d976bc874a56347f57472adcd2db513afe5b84aa4e9dd9c65614e4932e15
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionratonratpersistenceprivilege_escalationstealer

    • Detects RatonRAT payload

    • Family: RatonRAT

      RatonRAT is an information stealer written in C#.

      stealerratonrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Modifies Windows Firewall

      defense_evasion

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks