Analysis
- user interaction
yes - max time kernel
68s - max time network
69s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Unknown RAT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Unknown RAT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Unknown RAT.exe
- Size 2.4MB
- Sample260817-e7l3kael3w
- SHA256 3f96a6e9f20241b149ebbc91f9e22f69722515e79bcbbc3c002fc2364f5e80b0
- MD5 5ad1ea30a3026b02128db8ff57516aa3
- SHA1 3bd292a3abcba42034842f2e6361ce285bc7d779
- SHA512 f864e23792701d2de3e9691382c8682f14fc657d6bf8917cb32f24e32877ddcde01e33b05b05218d828efab5c32c218ff75cf5f2306b250b4c0accd6072e7f53
- SSDEEP 49152:/NBFA/JYDRinDkJ/RrbN2hSQr3vO658Y0Qz+VoMm2QAaFCK:8qBJZrk0of1L
- TLSH T110C5595E40189378F7AAC4E9850E7A4130F93BBC8DF290A8251B49B15B657E0DFD3B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsoft = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Unknown RAT.exe" Unknown RAT.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 3 ip-api.com - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2928 taskmgr.exe Token: SeSystemProfilePrivilege 2928 taskmgr.exe Token: SeCreateGlobalPrivilege 2928 taskmgr.exe Token: 33 2928 taskmgr.exe Token: SeIncBasePriorityPrivilege 2928 taskmgr.exe - Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe 2928 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2928 taskmgr.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Unknown RAT.exe"C:\Users\Admin\AppData\Local\Temp\Unknown RAT.exe"1⤵
- Adds Run key to start application
PID:4192
-
C:\Users\Admin\AppData\Local\Temp\Unknown RAT.exe"C:\Users\Admin\AppData\Local\Temp\Unknown RAT.exe"1⤵PID:5936
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2928