prorat | bd20aa0032f07ca9bbf8dee97a6ee9e6f1c391f0eb09eb9b714c0fa984307b4e

Analysis

max time kernel
149s
max time network
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/09/2026, 01:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__d773c26b46e774b66d0c5b90c94b2ca8.exe
Size 344KB
Sample260918-bkhj3stclf
SHA256 bd20aa0032f07ca9bbf8dee97a6ee9e6f1c391f0eb09eb9b714c0fa984307b4e
MD5 d773c26b46e774b66d0c5b90c94b2ca8
SHA1 acf7f9c8e67a25397d119bc5dc7245343e27118e
SHA512 37b1d58ded5d3c4413bcec8653887afa3c72b27fb07c41405c2aa8a0abca9ca60626b3208ba56ed60d3495f43d1b3a43146a79daed87c1af8f1f306beb30a1ac
SSDEEP 6144:a6gJbaRkNJvY2k0bsRkcQRkfIwps+69yV9Goa0ixEHzBmcrBlVZU+ivKs:Qbm8qN0bFciRwf69GxiKTBvVZe
TLSH
T14D74233FCBAB1662C91F43B907206F341C6D59580D1122AE687C74D93BB5291F8EC9AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 discovery execution prorat persistence rat upx

Malware Config

Signatures

Family: ProRat
ProRat is a Windows RAT written in C++.
rat prorat

Detects ProRat payload 6 IoCs

resource	yara_rule
behavioral2/memory/4780-13-0x0000000000400000-0x00000000005F9000-memory.dmp	family_prorat
behavioral2/memory/1112-15-0x0000000000400000-0x00000000005F9000-memory.dmp	family_prorat
behavioral2/memory/1112-37-0x0000000000400000-0x00000000005F9000-memory.dmp	family_prorat
behavioral2/memory/4780-41-0x0000000000400000-0x00000000005F9000-memory.dmp	family_prorat
behavioral2/memory/1720-44-0x0000000000400000-0x00000000005F9000-memory.dmp	family_prorat
behavioral2/memory/1720-47-0x0000000000400000-0x00000000005F9000-memory.dmp	family_prorat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	ntlcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	ntlcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ntlcs.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	ntlcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	ntlcs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	ntlcs.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c58a-18.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
4780	ntlcs.exe
1112	fservice.exe
1720	services.exe

Loads dropped DLL 5 IoCs

pid	Process
1720	services.exe
1720	services.exe
1720	services.exe
1112	fservice.exe
4780	ntlcs.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	ntlcs.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fservice.exe	ntlcs.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	ntlcs.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001b85a-5.dat	upx
behavioral2/memory/4780-9-0x0000000000400000-0x00000000005F9000-memory.dmp	upx
behavioral2/memory/4780-13-0x0000000000400000-0x00000000005F9000-memory.dmp	upx
behavioral2/memory/1112-15-0x0000000000400000-0x00000000005F9000-memory.dmp	upx
behavioral2/memory/1112-37-0x0000000000400000-0x00000000005F9000-memory.dmp	upx
behavioral2/memory/4780-41-0x0000000000400000-0x00000000005F9000-memory.dmp	upx
behavioral2/memory/1720-44-0x0000000000400000-0x00000000005F9000-memory.dmp	upx
behavioral2/memory/1720-47-0x0000000000400000-0x00000000005F9000-memory.dmp	upx

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	ntlcs.exe
File opened for modification	C:\Windows\system\sservice.exe	ntlcs.exe
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
952	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__d773c26b46e774b66d0c5b90c94b2ca8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ntlcs.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe
1720	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1720	services.exe
1720	services.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 4780	2452	jaffacakes118__d773c26b46e774b66d0c5b90c94b2ca8.exe	86
PID 4780 wrote to memory of 1112	4780	ntlcs.exe	87
PID 1112 wrote to memory of 1720	1112	fservice.exe	88
PID 1720 wrote to memory of 3908	1720	services.exe	89
PID 1720 wrote to memory of 2484	1720	services.exe	90
PID 1720 wrote to memory of 4312	1720	services.exe	91
PID 2484 wrote to memory of 4616	2484	NET.exe	95
PID 3908 wrote to memory of 1104	3908	NET.exe	96
PID 4780 wrote to memory of 952	4780	ntlcs.exe	97
PID 4312 wrote to memory of 4812	4312	NET.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d773c26b46e774b66d0c5b90c94b2ca8.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__d773c26b46e774b66d0c5b90c94b2ca8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\ntlcs.exe
  "C:\ntlcs.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\fservice.exe
    C:\Windows\system32\fservice.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\services.exe
      C:\Windows\services.exe -XP
      4⤵
      Modifies WinLogon for persistence
      Adds policy Run key to start application
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP SharedAccess
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3908
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SharedAccess
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP srservice
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2484
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
    - - C:\Windows\SysWOW64\NET.exe
        
        NET STOP navapsvc
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4312
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\ntlcs.exe.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

reginv.dll

Path C:\Windows\SysWOW64\reginv.dll
Size 20KB
SHA256 6f2c2b2c8733eac6ca9fb1e95804ab08fcff20caa9e2a59b300400f18900b874
MD5 904f3b552d0b762edb4520163d12d3cf
SHA1 5cca6b60732fe12d5d0d33e2fb2eb0c9004b9a8a
SHA512 14a8855ea04cf0bd9508bca077995eb4700988043ae63b8c320762904f415b0a29de5f9bfd8f1c1b9e1cd76700e6e988569b33f14c8a3ed16fa6eade10ab40a4
SSDEEP 384:/LD+0AXcpsCTU5M9FTmcI3zmlHFLiqfyVRjdELQgNoUoXnv:/LSMpH6AFTmV+iAIELjiUoX
TLSH
T139924B2439C143BFD2BAA53550E56B3B99FF782409E148875772EDA62D32180BD3B387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winkey.dll

Path C:\Windows\SysWOW64\winkey.dll
Size 16KB
SHA256 5b308dfdd00dadc887a56f90e05ebfa9963be0c463d524e2ddd8680cb810d2d8
MD5 d910659cca6a1650c10ff263c8a10fe7
SHA1 d38dbccb50b63430a51d8f6df2a6c4d23677cff0
SHA512 30c2e455478d270fc1800d251e36014f16c5e7dd9e67c1c1b0f5d4e6070fbd2875c6706efff710b83897704cefb10c7ce1b5c993548568c1f142e5b5c8d44df4
SSDEEP 192:N/o3C/IPOTDdgPubAxQwCMrpY7S8LqPZo5LdCfuR1nuO3In:NL/IGTnAxQr6+S9Pfu7n5
TLSH
T104726ED3EE8488F7C08D25F171D71E4F822D50524CE143A39AE4890F3D5161AF6AEB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntlcs.exe

Path C:\ntlcs.exe
Size 342KB
SHA256 26d580ffb52cc77cf17041db354f93b1f67e190f0860d47325f5ddfe01721504
MD5 390b4366aafe8a99cae0c556bf3d2451
SHA1 cbde9de6126f432abc52289ed9328b2376674d0e
SHA512 0dd1c65fa7c3c9eac855ccadedd19274466fbbf4e3459be0f78f84923f35d8636c29a5d737362ebfb005b9a52b3022c0c943fcc76baebcd57b0852eb68e83ffc
SSDEEP 6144:w6gJbaRkNJvY2k0bsRkcQRkfIwps+69yV9Goa0ixEHzBmcrBlVZU+ivKsh:ebm8qN0bFciRwf69GxiKTBvVZeb
TLSH
T1CB74233FCBAB1662C95F83B917206E341C7D29480D1532AE687C74D43BB9191F4E89AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntlcs.exe.bat

Path C:\ntlcs.exe.bat
Size 65B
SHA256 2d9e5f8e2e07af35bc25e26a94626c3fef53f67917e52d9d2dfa8141a75c469e
MD5 6b2067c2c8f2136b297db8eccaec82a7
SHA1 433d0bfd6a279089a3b722db95add36c91d823d9
SHA512 c277ce06da7202dee745fb793c425072118cf9881586c9fdb52e174b291facbd6272a72a217900a2dde1812f9c0eed075f3a14ff098eac6ccb190c70678e777b
TLSH
T1FCA002504434A895D48046A4A60C3C46958E96F31C0D140D38A600C7DED207A616FBC2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1112-37-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/1112-38-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/1112-15-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/1112-31-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/1720-30-0x00000000049D0000-0x00000000049D8000-memory.dmp

Download

memory/1720-21-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/1720-44-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/1720-46-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/1720-47-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/2452-0-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/4780-13-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/4780-12-0x00000000005F8000-0x00000000005F9000-memory.dmp

Download

memory/4780-39-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/4780-41-0x0000000000400000-0x00000000005F9000-memory.dmp

Download

memory/4780-42-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/4780-9-0x0000000000400000-0x00000000005F9000-memory.dmp

Download