736749551049aeab7013609e8a24a3dfb999f5619d395e4e021d566d11702b03 | Triage

Resubmissions

23-04-2022 17:17

220423-vt64kshfdj 10

21-04-2022 15:50

220421-s9w77sbcdr 10

Analysis

max time kernel
57s
max time network
53s
platform
windows7_x64
resource
win7-20220414-en
submitted
23-04-2022 17:17

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Java.Ratty.2.15503.dll
Size

740KB
MD5

c361d2beccf54f9c0399a5dc1366c889
SHA1

1744e717854b7308abf1064c98c3da1bc5084035
SHA256

736749551049aeab7013609e8a24a3dfb999f5619d395e4e021d566d11702b03
SHA512

c148e7062a6a94161b266c709b907c8d16b2d9aa019291db17c28dd054eaf3a5fee07f81cb98f3bd61f7dca33d308ea8845f06016ccc07f0725c115542919376

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

rundll32.execmd.exe

description	pid	process	target process
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 1012 wrote to memory of 760	1012	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 1380	952	cmd.exe	rundll32.exe
PID 952 wrote to memory of 1380	952	cmd.exe	rundll32.exe
PID 952 wrote to memory of 1380	952	cmd.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.15503.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Java.Ratty.2.15503.dll,#1
  2⤵
  PID:760

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:2036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\system32\rundll32.exe
  rundll32 SecuriteInfo.com.Java.Ratty.2.15503.dll
  2⤵
  PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-54-0x0000000000000000-mapping.dmp

Download
memory/760-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download
memory/1380-57-0x0000000000000000-mapping.dmp

Download
memory/2036-56-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp

Filesize
8KB

Download