a36dfd921c39526058143f74fc1ac216baefe20b260a975c6e24b9f12fca355c

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RatDecoder.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RatDecoder.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RatDecoder.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	RatDecoder.exe

Executes dropped EXE 3 IoCs

pid	Process
4600	RatDecoder.exe
3480	DirectX setup.exe
1608	DirectX setup.exe

Loads dropped DLL 17 IoCs

pid	Process
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe
1608	DirectX setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/4472-0-0x0000000000400000-0x0000000001298000-memory.dmp	themida
behavioral1/memory/4472-1-0x0000000000400000-0x0000000001298000-memory.dmp	themida
behavioral1/memory/4472-42-0x0000000000400000-0x0000000001298000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RatDecoder.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
12	discord.com
15	discord.com
18	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

persistence privilege_escalation

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
6	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4472	RatDecoder.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\DirectX setup.exe	RatDecoder.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000800000002446c-36.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4912	cmd.exe
4188	cmd.exe
2544	cmd.exe
1176	cmd.exe
3228	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DirectX setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DirectX setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RatDecoder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RatDecoder.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
4188	cmd.exe
1444	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DirectX setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DirectX setup.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
4996	WMIC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4472	RatDecoder.exe
4472	RatDecoder.exe
1216	powershell.exe
1216	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeIncreaseQuotaPrivilege	1764	WMIC.exe
Token: SeSecurityPrivilege	1764	WMIC.exe
Token: SeTakeOwnershipPrivilege	1764	WMIC.exe
Token: SeLoadDriverPrivilege	1764	WMIC.exe
Token: SeSystemProfilePrivilege	1764	WMIC.exe
Token: SeSystemtimePrivilege	1764	WMIC.exe
Token: SeProfSingleProcessPrivilege	1764	WMIC.exe
Token: SeIncBasePriorityPrivilege	1764	WMIC.exe
Token: SeCreatePagefilePrivilege	1764	WMIC.exe
Token: SeBackupPrivilege	1764	WMIC.exe
Token: SeRestorePrivilege	1764	WMIC.exe
Token: SeShutdownPrivilege	1764	WMIC.exe
Token: SeDebugPrivilege	1764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1764	WMIC.exe
Token: SeRemoteShutdownPrivilege	1764	WMIC.exe
Token: SeUndockPrivilege	1764	WMIC.exe
Token: SeManageVolumePrivilege	1764	WMIC.exe
Token: 33	1764	WMIC.exe
Token: 34	1764	WMIC.exe
Token: 35	1764	WMIC.exe
Token: 36	1764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1764	WMIC.exe
Token: SeSecurityPrivilege	1764	WMIC.exe
Token: SeTakeOwnershipPrivilege	1764	WMIC.exe
Token: SeLoadDriverPrivilege	1764	WMIC.exe
Token: SeSystemProfilePrivilege	1764	WMIC.exe
Token: SeSystemtimePrivilege	1764	WMIC.exe
Token: SeProfSingleProcessPrivilege	1764	WMIC.exe
Token: SeIncBasePriorityPrivilege	1764	WMIC.exe
Token: SeCreatePagefilePrivilege	1764	WMIC.exe
Token: SeBackupPrivilege	1764	WMIC.exe
Token: SeRestorePrivilege	1764	WMIC.exe
Token: SeShutdownPrivilege	1764	WMIC.exe
Token: SeDebugPrivilege	1764	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1764	WMIC.exe
Token: SeRemoteShutdownPrivilege	1764	WMIC.exe
Token: SeUndockPrivilege	1764	WMIC.exe
Token: SeManageVolumePrivilege	1764	WMIC.exe
Token: 33	1764	WMIC.exe
Token: 34	1764	WMIC.exe
Token: 35	1764	WMIC.exe
Token: 36	1764	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4996	WMIC.exe
Token: SeSecurityPrivilege	4996	WMIC.exe
Token: SeTakeOwnershipPrivilege	4996	WMIC.exe
Token: SeLoadDriverPrivilege	4996	WMIC.exe
Token: SeSystemProfilePrivilege	4996	WMIC.exe
Token: SeSystemtimePrivilege	4996	WMIC.exe
Token: SeProfSingleProcessPrivilege	4996	WMIC.exe
Token: SeIncBasePriorityPrivilege	4996	WMIC.exe
Token: SeCreatePagefilePrivilege	4996	WMIC.exe
Token: SeBackupPrivilege	4996	WMIC.exe
Token: SeRestorePrivilege	4996	WMIC.exe
Token: SeShutdownPrivilege	4996	WMIC.exe
Token: SeDebugPrivilege	4996	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4996	WMIC.exe
Token: SeRemoteShutdownPrivilege	4996	WMIC.exe
Token: SeUndockPrivilege	4996	WMIC.exe
Token: SeManageVolumePrivilege	4996	WMIC.exe
Token: 33	4996	WMIC.exe
Token: 34	4996	WMIC.exe
Token: 35	4996	WMIC.exe
Token: 36	4996	WMIC.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1216	4472	RatDecoder.exe	85
PID 4472 wrote to memory of 4600	4472	RatDecoder.exe	87
PID 4472 wrote to memory of 3480	4472	RatDecoder.exe	89
PID 3480 wrote to memory of 1608	3480	DirectX setup.exe	90
PID 1608 wrote to memory of 4188	1608	DirectX setup.exe	91
PID 1608 wrote to memory of 4912	1608	DirectX setup.exe	92
PID 4912 wrote to memory of 1764	4912	cmd.exe	95
PID 4188 wrote to memory of 1444	4188	cmd.exe	96
PID 1608 wrote to memory of 2544	1608	DirectX setup.exe	98
PID 1608 wrote to memory of 1176	1608	DirectX setup.exe	100
PID 1608 wrote to memory of 3228	1608	DirectX setup.exe	102
PID 1176 wrote to memory of 4996	1176	cmd.exe	104
PID 3228 wrote to memory of 1428	3228	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\RatDecoder.exe
"C:\Users\Admin\AppData\Local\Temp\RatDecoder.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAcgBkACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAYwBjACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAdQBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAdgBkACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Users\Admin\RatDecoder.exe
  "C:\Users\Admin\RatDecoder.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4600
- C:\Windows\DirectX setup.exe
  "C:\Windows\DirectX setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\DirectX setup.exe
    "C:\Windows\DirectX setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path softwarelicensingservice get OA3xOriginalProductKey
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:1764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:2544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where "PartialProductKey is not null" get Name,PartialProductKey /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Debugger Evasion

T1622

Query Registry

System Information Discovery