Analysis
- max time kernel
40s - max time network
52s - platform
windows7_x64 - resource
win7-20220414-en - submitted
10/06/2022, 18:07
General
- Target d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe
- Sample220610-wqa3eaeadj
Score
10/10
Malware Config
Extracted
Family
-
recordbreaker
C2
-
http://retro-rave.xyz/
Signatures
- RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
- suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
- suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
suricata: ET MALWARE Recordbreaker Stealer CnC Checkin
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe"C:\Users\Admin\AppData\Local\Temp\d3b492cf1b98b184b1a6c24c79c57bf8acd7c67fde824192819e07f597b3a997.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1276-54-0x0000000000BD0000-0x00000000015C2000-memory.dmp
memory/1276-56-0x00000000756E1000-0x00000000756E3000-memory.dmp
memory/1276-57-0x0000000000BD0000-0x00000000015C2000-memory.dmp
memory/1276-58-0x0000000000BD0000-0x00000000015C2000-memory.dmp