recordbreaker | 1d7f1d8f1bd2d985c830f0b119cceaa6694575361a58bbe383c8c063d57a768b | Triage

Analysis

max time kernel
40s
max time network
52s
platform
windows7_x64
resource
win7-20220414-en
submitted
10-06-2022 18:07

Sharing

Report Analysis Logs

General

Target

d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe

Score

10^/10

recordbreaker stealer suricata

Malware Config

Extracted

Family

recordbreaker

C2

http://retro-rave.xyz/

Signatures

RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
stealer recordbreaker
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
suricata
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe

pid	process
1276	d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe
1276	d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe

C:\Users\Admin\AppData\Local\Temp\d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe
"C:\Users\Admin\AppData\Local\Temp\d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-54-0x0000000000BD0000-0x00000000015C2000-memory.dmp

Filesize
9.9MB

Download
memory/1276-56-0x00000000756E1000-0x00000000756E3000-memory.dmp

Filesize
8KB

Download
memory/1276-57-0x0000000000BD0000-0x00000000015C2000-memory.dmp

Filesize
9.9MB

Download
memory/1276-58-0x0000000000BD0000-0x00000000015C2000-memory.dmp

Filesize
9.9MB

Download