prorat | 65876ae455c49f862d523e7b5aee96d664dca7b61b33e3662db2af613d440041

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Size 365KB
Sample260920-1682laer3t
SHA256 65876ae455c49f862d523e7b5aee96d664dca7b61b33e3662db2af613d440041
MD5 2859aacccf9d2f94469f093096337cc3
SHA1 9862c618e1e732c5f2842325fa2409d28bb3b169
SHA512 9b2d9a755002cf47d2f9462edd0676aacb3342bd553ada8db52ee74bb90ea4240fcaac328be68b81bb2f9ed4c06f03e05dc32c25060b4852d2b1b8f835f706a7
SSDEEP 6144:F6xCheLx0/s2HSv469p9shzpaVG4K7vGDsr6p1Uo+TUihkl6hq:FLCx0Sv4osnaVXUvzr6XjWgOq
TLSH
T1A984E0516BFD0FDDF4B6AB36A264B822F1964878E3F70176B4E5CC528683411DF84B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 discovery execution prorat persistence rat

Malware Config

Signatures

Family: ProRat
ProRat is a Windows RAT written in C++.
rat prorat

Detects ProRat payload 8 IoCs

resource	yara_rule
behavioral2/memory/4712-2-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/2236-4-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/4412-7-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/4412-8-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/2236-29-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/4712-32-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/4412-35-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat
behavioral2/memory/4412-38-0x0000000000400000-0x00000000005F8000-memory.dmp	family_prorat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0007000000011392-3.dat	aspack_v212_v242
behavioral2/files/0x001600000001c33b-9.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
2236	fservice.exe
4412	services.exe

Loads dropped DLL 5 IoCs

pid	Process
4412	services.exe
4412	services.exe
4412	services.exe
2236	fservice.exe
4712	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
File opened for modification	C:\Windows\system\sservice.exe	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
File created	C:\Windows\services.exe	fservice.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2248	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NET.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe
4412	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4412	services.exe
4412	services.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 2236	4712	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe	91
PID 2236 wrote to memory of 4412	2236	fservice.exe	92
PID 4412 wrote to memory of 4396	4412	services.exe	94
PID 4412 wrote to memory of 5984	4412	services.exe	95
PID 4412 wrote to memory of 3500	4412	services.exe	96
PID 5984 wrote to memory of 4160	5984	NET.exe	100
PID 4712 wrote to memory of 2248	4712	jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe	101
PID 4396 wrote to memory of 4604	4396	NET.exe	102
PID 3500 wrote to memory of 2648	3500	NET.exe	103

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\fservice.exe
  C:\Windows\system32\fservice.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\services.exe
    C:\Windows\services.exe -XP
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP SharedAccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4604
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
  - - C:\Windows\SysWOW64\NET.exe
      NET STOP navapsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 STOP navapsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe.bat

Path C:\Users\Admin\AppData\Local\Temp\jaffacakes118__2859aacccf9d2f94469f093096337cc3.exe.bat
Size 133B
SHA256 cf0513e7b760b2838477996e6ae09781c98f32a2d4791471f6b82b1d77cd5ee4
MD5 127346527a8f51194d7dbc218380f5eb
SHA1 f9e10acb2252d09a4fd584b4a43f290964a0f9ae
SHA512 51ed0ea6d24882dcd937dfee513bf92184ecea21920012c940c60a03db3b213ccb4218ac30f0360918f48b1fa739223357a3d4f8789cc394f0f4f829533b8651
TLSH
T15DC09B01C1DAD65F0984636706E5954CC0ACDD6D2E4F3F24DA65845C315245DF587B45
MD5 SHA1 SHA512 TLSH

Submit Download

fservice.exe

Path C:\Windows\SysWOW64\fservice.exe
Size 365KB
SHA256 65876ae455c49f862d523e7b5aee96d664dca7b61b33e3662db2af613d440041
MD5 2859aacccf9d2f94469f093096337cc3
SHA1 9862c618e1e732c5f2842325fa2409d28bb3b169
SHA512 9b2d9a755002cf47d2f9462edd0676aacb3342bd553ada8db52ee74bb90ea4240fcaac328be68b81bb2f9ed4c06f03e05dc32c25060b4852d2b1b8f835f706a7
SSDEEP 6144:F6xCheLx0/s2HSv469p9shzpaVG4K7vGDsr6p1Uo+TUihkl6hq:FLCx0Sv4osnaVXUvzr6XjWgOq
TLSH
T1A984E0516BFD0FDDF4B6AB36A264B822F1964878E3F70176B4E5CC528683411DF84B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reginv.dll

Path C:\Windows\SysWOW64\reginv.dll
Size 20KB
SHA256 6f2c2b2c8733eac6ca9fb1e95804ab08fcff20caa9e2a59b300400f18900b874
MD5 904f3b552d0b762edb4520163d12d3cf
SHA1 5cca6b60732fe12d5d0d33e2fb2eb0c9004b9a8a
SHA512 14a8855ea04cf0bd9508bca077995eb4700988043ae63b8c320762904f415b0a29de5f9bfd8f1c1b9e1cd76700e6e988569b33f14c8a3ed16fa6eade10ab40a4
SSDEEP 384:/LD+0AXcpsCTU5M9FTmcI3zmlHFLiqfyVRjdELQgNoUoXnv:/LSMpH6AFTmV+iAIELjiUoX
TLSH
T139924B2439C143BFD2BAA53550E56B3B99FF782409E148875772EDA62D32180BD3B387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winkey.dll

Path C:\Windows\SysWOW64\winkey.dll
Size 16KB
SHA256 5b308dfdd00dadc887a56f90e05ebfa9963be0c463d524e2ddd8680cb810d2d8
MD5 d910659cca6a1650c10ff263c8a10fe7
SHA1 d38dbccb50b63430a51d8f6df2a6c4d23677cff0
SHA512 30c2e455478d270fc1800d251e36014f16c5e7dd9e67c1c1b0f5d4e6070fbd2875c6706efff710b83897704cefb10c7ce1b5c993548568c1f142e5b5c8d44df4
SSDEEP 192:N/o3C/IPOTDdgPubAxQwCMrpY7S8LqPZo5LdCfuR1nuO3In:NL/IGTnAxQr6+S9Pfu7n5
TLSH
T104726ED3EE8488F7C08D25F171D71E4F822D50524CE143A39AE4890F3D5161AF6AEB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2236-29-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/2236-4-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/2236-30-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/2236-22-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/4412-7-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4412-12-0x0000000010000000-0x000000001000B000-memory.dmp

Download

memory/4412-8-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4412-21-0x0000000000F90000-0x0000000000F98000-memory.dmp

Download

memory/4412-35-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4412-38-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4712-27-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/4712-0-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4712-2-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4712-32-0x0000000000400000-0x00000000005F8000-memory.dmp

Download

memory/4712-33-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/4712-1-0x00000000005F6000-0x00000000005F7000-memory.dmp

Download