Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MyFlaskRat' = '%APPDATA%\MyFlaskRat\<File name>.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsUpdateService' = 'wscript.exe "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdateService.vbs"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdateservice.vbs
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 3844
- '%WINDIR%\syswow64\taskkill.exe' /F /PID 1340
Modifies file system
Creates the following files
- %TEMP%\_mei38442\pil\_avif.cp314-win32.pyd
- %TEMP%\_mei38442\pil\_imaging.cp314-win32.pyd
- %TEMP%\_mei38442\pil\_imagingcms.cp314-win32.pyd
- %TEMP%\_mei38442\pil\_imagingft.cp314-win32.pyd
- %TEMP%\_mei38442\pil\_imagingmath.cp314-win32.pyd
- %TEMP%\_mei38442\pil\_imagingtk.cp314-win32.pyd
- %TEMP%\_mei38442\pil\_webp.cp314-win32.pyd
- %TEMP%\_mei38442\vcruntime140.dll
- %TEMP%\_mei38442\_bz2.pyd
- %TEMP%\_mei38442\_ctypes.pyd
- %TEMP%\_mei38442\_decimal.pyd
- %TEMP%\_mei38442\_elementtree.pyd
- %TEMP%\_mei38442\_hashlib.pyd
- %TEMP%\_mei38442\_lzma.pyd
- %TEMP%\_mei38442\_queue.pyd
- %TEMP%\_mei38442\_socket.pyd
- %TEMP%\_mei38442\_ssl.pyd
- %TEMP%\_mei38442\_wmi.pyd
- %TEMP%\_mei38442\_zstd.pyd
- %TEMP%\_mei38442\base_library.zip
- %TEMP%\_mei38442\certifi\cacert.pem
- %TEMP%\_mei38442\charset_normalizer\md.cp314-win32.pyd
- %TEMP%\_mei38442\charset_normalizer\md__mypyc.cp314-win32.pyd
- %TEMP%\_mei38442\libcrypto-3.dll
- %TEMP%\_mei38442\libffi-8.dll
- %TEMP%\_mei38442\libssl-3.dll
- %TEMP%\_mei38442\pyexpat.pyd
- %TEMP%\_mei38442\python314.dll
- %TEMP%\_mei38442\select.pyd
- %TEMP%\_mei38442\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei38442\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei38442\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei38442\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei38442\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei38442\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei38442\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei38442\unicodedata.pyd
- %TEMP%\client_debug.log
- nul
- %APPDATA%\myflaskrat\<File name>.exe
- %TEMP%\_mei13402\pil\_avif.cp314-win32.pyd
- %TEMP%\_mei13402\pil\_imaging.cp314-win32.pyd
- %TEMP%\_mei13402\pil\_imagingcms.cp314-win32.pyd
- %TEMP%\_mei13402\pil\_imagingft.cp314-win32.pyd
- %TEMP%\_mei13402\pil\_imagingmath.cp314-win32.pyd
- %TEMP%\_mei13402\pil\_imagingtk.cp314-win32.pyd
- %TEMP%\_mei13402\pil\_webp.cp314-win32.pyd
- %TEMP%\_mei13402\vcruntime140.dll
- %TEMP%\_mei13402\_bz2.pyd
- %TEMP%\_mei13402\_ctypes.pyd
- %TEMP%\_mei13402\_decimal.pyd
- %TEMP%\_mei13402\_elementtree.pyd
- %TEMP%\_mei13402\_hashlib.pyd
- %TEMP%\_mei13402\_lzma.pyd
- %TEMP%\_mei13402\_queue.pyd
- %TEMP%\_mei13402\_socket.pyd
- %TEMP%\_mei13402\_ssl.pyd
- %TEMP%\_mei13402\_wmi.pyd
- %TEMP%\_mei13402\_zstd.pyd
- %TEMP%\_mei13402\base_library.zip
- %TEMP%\_mei13402\certifi\cacert.pem
- %TEMP%\_mei13402\charset_normalizer\md.cp314-win32.pyd
- %TEMP%\_mei13402\charset_normalizer\md__mypyc.cp314-win32.pyd
- %TEMP%\_mei13402\libcrypto-3.dll
- %TEMP%\_mei13402\libffi-8.dll
- %TEMP%\_mei13402\libssl-3.dll
- %TEMP%\_mei13402\pyexpat.pyd
- %TEMP%\_mei13402\python314.dll
- %TEMP%\_mei13402\select.pyd
- %TEMP%\_mei13402\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\installer
- %TEMP%\_mei13402\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\metadata
- %TEMP%\_mei13402\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\record
- %TEMP%\_mei13402\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\wheel
- %TEMP%\_mei13402\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\licenses\license
- %TEMP%\_mei13402\setuptools\_vendor\importlib_metadata-8.7.1.dist-info\top_level.txt
- %TEMP%\_mei13402\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei13402\unicodedata.pyd
Network activity
Connects to
- 'cp#####syk.onrender.com':443
TCP
Other
- 'cp#####syk.onrender.com':443
UDP
- DNS ASK cp#####syk.onrender.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%APPDATA%\myflaskrat\<File name>.exe'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "ver"
- '%WINDIR%\syswow64\cmd.exe' /c "tasklist /FO CSV /NH"
- '%WINDIR%\syswow64\tasklist.exe' /FO CSV /NH
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /F /PID 3844"
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /F /PID 1340"
- '%WINDIR%\syswow64\cmd.exe' /c "ver"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "tasklist /FO CSV /NH"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /F /PID 3844"' (with hidden window)
- '%APPDATA%\myflaskrat\<File name>.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "taskkill /F /PID 1340"' (with hidden window)
