evolutionrat | 77261825ac2b9fc0b70b9b0c93124c767133a904f2f4d38a452ed6033e18c180

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/10/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spanic.vbs
Size 3.0MB
Sample261028-ypckyshd22
SHA256 77261825ac2b9fc0b70b9b0c93124c767133a904f2f4d38a452ed6033e18c180
MD5 3f457021db7dc4595c505c517d02af2a
SHA1 e5641a94ac47678b206d796e9c2cb357d3d2e199
SHA512 8f288c748de101bc0c126f6426e55d7e67ad135866cdb372efc4af1f5c81d25d0c6a0911bc9ec5c0a5966437bd3f796645555dab9177155630ace8849f1806e4
SSDEEP 49152:E1r7Oc1DHA0o6fgRSEYUaDFxwSieWWdy4S:P
TLSH
T121E5120E9BBF1F5E84FA845D0AAD56CBE9AE0550CB50E77A7B686506C74CF20CC46C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution evolutionrat persistence privilege_escalation rat

Malware Config

Extracted

Family

evolutionrat

misamario1.dynuddns.com:4090

Attributes

install
false

Signatures

Family: EvolutionRAT
EvolutionRAT is a Windows RAT written in C.
rat evolutionrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4336	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DefShieldRVDzUn.vbs	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4580	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4336 set thread context of 5488	4336	powershell.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	WScript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4336	powershell.exe
4336	powershell.exe
4336	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4336	4580	WScript.exe	90
PID 4336 wrote to memory of 2488	4336	powershell.exe	92
PID 2488 wrote to memory of 3556	2488	csc.exe	93
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94
PID 4336 wrote to memory of 5488	4336	powershell.exe	94

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\spanic.vbs"
1⤵
- Creates a file in the Startup directory
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -NoLogo -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\5A51AA7F.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0aurde3n\0aurde3n.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES939B.tmp" "c:\Users\Admin\AppData\Local\Temp\0aurde3n\CSC635D3DB42C13439F914BBF852FF02ACC.TMP"
      4⤵
      PID:3556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:5488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0aurde3n.dll

Path C:\Users\Admin\AppData\Local\Temp\0aurde3n\0aurde3n.dll
Size 5KB
SHA256 6bacc67f1481342610bad06e2fe91210a348010bd720960d58c1f98b72b76151
MD5 08f22f0143d84072138a7d5f150fb305
SHA1 3bbf910bd0f103b9f98b4e9acb43f600808e7a78
SHA512 c8f96d82938a051e435b86524f56c1890d343d9e0cecdf16468791e3a6ba8f172deda12c1b0fc1cf2875b1c304a58e503e60947c796d82c75cdc834bf5fa2e1f
SSDEEP 96:71izTITe95tjQkJwnmcS32QlNeN7/W/q74SCpaelH8uodWAK:71mcktMUwnmc42QlNeN7/W/q74BpaeBX
TLSH
T11FC17757A7D81665D2E3277DB5620721C2B8F425AD7BA74F0989333DACE7B0098A2730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5A51AA7F.ps1

Path C:\Users\Admin\AppData\Local\Temp\5A51AA7F.ps1
Size 2.9MB
SHA256 2bbb0bf5619c37a7f514a3feeea6a2fb22288a271961147bbcb4294515ad29e9
MD5 4ebe04f4524bee65ba76577de0ec38eb
SHA1 bc180ea3eab9e3ce3dccc6b95edd8051d92d4a63
SHA512 8c79a88680889fdfd9286d1bde8383210a6b0a8c50819a1b985ca310aa3e0ef621d47a57364c946f412b59cb44f7c59a070a77d1e5c4e2feda40ace1577fb994
SSDEEP 49152:afoTP2Px4CP09SnY5ioMVazzoWoLPwuiJn:H
TLSH
T1A6E5131E87FF0F9A89BBC41813AD97CBE5AE0560CA10D7767BA82546C74CF60C846D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES939B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES939B.tmp
Size 1KB
SHA256 d6c2c9520c661c833f63c816e9f2f65a43f058727604f8186fc8f790d8bc160a
MD5 c8f9e5a6da24abf9e08618f087fbe146
SHA1 18f86f2cdf9f597632a5b8b8d6018f4b063b13bb
SHA512 902ec74af57b2224d93642a785b164234074701ef50e6e051a5c500682f45ac0b4791d06aebd328309f098b4d49c968bf57524022899c0b706cd0ef66abd1a3a
TLSH
T1C221A60593F84B1EF07347326AF6172F9274FD65EFA2535F884082282C51204EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

0aurde3n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\0aurde3n\0aurde3n.0.cs
Size 2KB
SHA256 b53f74082b81bf5fb37c409bee0ca3131ad90ffb621ce8ad30b2657a77d4325d
MD5 e68dd91a9bee4a65c8bd88f3dad0f58d
SHA1 cc35ef73c13e749ac238f03a9447b5a21f5636e4
SHA512 16f787720cacd9909cc647cc2c2f33e35165b2497b5598055f96b53eda66b6fac3b0afd3a847fe562b724ccd33bea3a82abb8309dbd1597888df0635e5ad54a6
TLSH
T12C4186294395D27E85A7296EDDDAC72FE613753226FC3A0005BB9F200E56249E07732A
MD5 SHA1 SHA512 TLSH

Submit Download

0aurde3n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\0aurde3n\0aurde3n.cmdline
Size 369B
SHA256 d989fb905f83aa9ae491ade52f1f7eb5a0bc5a9826a3bd1086c1938089490efc
MD5 beb1c303963b975ea43737d98663e5e0
SHA1 ec731d479d2d040461adaf23172e748d612d66d4
SHA512 1aee9e5e8e190ddbe54027e2eb7aba30f260c30357aac8bfba89a2c30b3f030c13e1bb39d0a38403c23f04750d9f17f0b90b7dda9c6ddf752e66bf50bba98147
TLSH
T170E0682A4646C6BD03D978072179CCAC83724663A9833F846064848DF05785027D3741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC635D3DB42C13439F914BBF852FF02ACC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\0aurde3n\CSC635D3DB42C13439F914BBF852FF02ACC.TMP
Size 652B
SHA256 5183fd86b7809309d271f17fe0c816cd28fad9ca7418a5dc51936f084dd18603
MD5 fb1aa55fb20ad807278127c86c4585c0
SHA1 6f5131b56db84cd4dc3415da94cb6f96c72bb3cd
SHA512 17d33ec3bfdca37b95e07ae23e9ede7fd9b42ee9050a53b47f2b478e56a4a8521ee79c2ae5393f23248cdbfe2911e88fc4580b88d71def0805c1ff5219dee975
TLSH
T11FF05E0AA3F8021EF0F34B71BDF6436391A9BC65DE7293ED185043292C646109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4336-12-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-22-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-14-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-15-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-16-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-19-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-20-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-21-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-23-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-13-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-4-0x00007FF81C4EF000-0x00007FF81C4F0000-memory.dmp

Download

memory/4336-10-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-9-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-8-0x000001A433030000-0x000001A433052000-memory.dmp

Download

memory/4336-36-0x000001A432C40000-0x000001A432C48000-memory.dmp

Download

memory/4336-7-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-37-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/4336-41-0x00007FF81C360000-0x00007FF81CD04000-memory.dmp

Download

memory/5488-38-0x0000000140000000-0x00000001401CB000-memory.dmp

Download