Analysis
-
max time kernel
149s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.4081.402.exe
Resource
win7-20220812-en
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.4081.402.exe
-
Size
376KB
-
MD5
c163e6373c79d67028018aff550eb7d8
-
SHA1
99d5cfe2a7ea1b0e67028c790e58440d8ada545b
-
SHA256
0bbbd33974826187303484cfab5e7172ad9360ff5cc3ddc6f4f4f66bf5888694
-
SHA512
348fab4295254952830515063b0359a33dcaa1b703ed3d8adba314e449d3f43c7f577ebf71c0ed8e663bc817dc4d7177a5998ed64ffa44b270ec1ba3879ca316
-
SSDEEP
6144:LpQrq2QuPkfqIjwsFXwbWeeG4uqVbYdUpgHkBwbpZy43bwOTfJIgh2OScFn0fccL:LpQWNuPkfq6zy4uqFpuC4nBlha
Malware Config
Extracted
formbook
ermr
ErOK6LFCgNIAlQmH54oaYOL/CN29Z78=
qNSdDhu/PT/1fgafDagiCSZH1SY=
wLpPOAkYS8EABl3pHGc4hNT/Q1sHBrU=
jSxRvptHkeTGl7PT0SEmaZmjqzanuA==
b91oL+2wCcpyhnd6yvF6Pg==
mr81yp1/qqZX
hy7Xsz/PU/LWHMcGL4UYJx9n3A==
KlwrHt1gouPaXaWhoQ==
ng8M320IRJL9Ptw=
8GQbOXuaWxvKnNM=
XndOL7E5sNpVUNty4d/a
rryPBBC8PybYb+2h2MF3FHGL
kEoeyERSVCYO0g==
5/P+SBDby5hO
1fYXc30/h9W7iO17
34X+YKR+wRFE
8ir/X2MlVByh5lQ1ow8=
u9ikm2UMZ7J7hpCYow==
FLI+c3clp1BNDjVAfvC2Dnw=
t21Erq8/r09wAzAJTAH3Ng==
VAg3gU1KH9uW3YIPAgc=
Gjlc09d6qurdLePSLZktDmGA1A==
MMraOD3ve5odaf+03cB3FHGL
mLRTTAycMcrHgomShQHVwfFKkGQaehvF
fpab65mlchvKnNM=
M6jUQU0omipqaUNXyvF6Pg==
S/XrNQGVvwUsSnKFyvF6Pg==
LeC0GeF2zvCosNtMx5RltjCD
Y+IGYC/XHS63wIus5n08ADN2qzanuA==
3tJus7Rc6OtWnx9y4d/a
4uSOYiXhGxumZcTLuA==
5PyP2thOiIucXaWhoQ==
6978Rw3FNTibYVQ1ow8=
3Ah90lcSVCYO0g==
V/UQWRsOOQjDye9m0cLQ
yRXcMfySzTmEhddhqljeGH8=
vWuKFZKZ48E=
8+UEda631IpZ
LUofBqVNdT/v+MXiEWm90Ape3g==
NCi29RHdDYd7hso=
i36jBdNko/HyUKg1eWYgJx9n3A==
vdblMhHYSkgDmBly4d/a
oQmZH6K31IpZ
fCBHqaFGx9OUMMuBr5GWDXXY5DAT
FDXweHcHVCYO0g==
qSQd9bd7BQavQ9NbcUT+O6e4OGsaehvF
vN98englU4HHzqi36ju/91SJ
prTUIBi6MhiXZFQ1ow8=
w008jVXdCYd7hso=
p1kghFnjD9iADog5cVDmvrDiTjk=
xLjHJFYDQL+ysdk=
6tiR9MZa9xSMXVQ1ow8=
WMzXJPGcyIrP2g==
SeI4PsQ+N/O0iMs=
+4o0lKRDsz+RUqpoBvt3FHGL
AHQG4ZsybzCo8ZlBs1jeGH8=
kIgR46ls4wiGUJZLtFjeGH8=
b/fmPTHIRhvKnNM=
lTL5XnA4eKLb4snpHXt2s/MaSVsHBrU=
psOQcAKjHxyFw0vIwrZ3FHGL
F806xNnby5hO
7t72ZXkhmSAc8xLYD4J2XXc=
Ihmk3OR96/2HSbdi
ea/NKy3VVcx7hpCYow==
ifair.ltd
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.4081.402.exedescription pid process target process PID 4688 set thread context of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3176 32 WerFault.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.4081.402.exedescription pid process target process PID 4688 wrote to memory of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe PID 4688 wrote to memory of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe PID 4688 wrote to memory of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe PID 4688 wrote to memory of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe PID 4688 wrote to memory of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe PID 4688 wrote to memory of 32 4688 SecuriteInfo.com.Win32.RATX-gen.4081.402.exe SecuriteInfo.com.Win32.RATX-gen.4081.402.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4081.402.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4081.402.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4081.402.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.4081.402.exe"2⤵PID:32
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 32 -s 1843⤵
- Program crash
PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 32 -ip 321⤵PID:2524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/32-136-0x0000000000000000-mapping.dmp
-
memory/32-137-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/32-138-0x0000000000810000-0x000000000083D000-memory.dmpFilesize
180KB
-
memory/4688-132-0x0000000000FB0000-0x0000000001014000-memory.dmpFilesize
400KB
-
memory/4688-133-0x0000000005FD0000-0x0000000006574000-memory.dmpFilesize
5.6MB
-
memory/4688-134-0x0000000005A20000-0x0000000005AB2000-memory.dmpFilesize
584KB
-
memory/4688-135-0x0000000003560000-0x00000000035C6000-memory.dmpFilesize
408KB