Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2022 09:38
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe
Resource
win7-20220901-en
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe
-
Size
946KB
-
MD5
591e345ed1a7fa929b80cce8790e460f
-
SHA1
9992eadbc531dce1185f22b360410cbd11bd1989
-
SHA256
663d25f6a1e39bebdacdb5164e441faaa4466a00ed636b360c1d981a5f92c5d8
-
SHA512
f765de77da52cb578a3a2a7ab0f3d8a34baa96db982f972dbe3bead73e418992ea5bf018b3619556ef83a9d05342b7c176579982fd017b9eeee3c75269dd7863
-
SSDEEP
24576:sqndl9aebRk+T7CYWL1wCE7HuzsthZmBHG:Ld3pbq+nnWL1w3TTthSH
Malware Config
Extracted
formbook
4.1
ndgi
vuicotvxrejp3il.xyz
w3fa6.net
sappuno02.com
konstruksirumah.xyz
usalifehealth.com
and1f.xyz
atenmentfstinfdow.beauty
primepipe.net
roundhouseny.com
alexandermcqueen.icu
transporteavalos.com
spankmetaverse.xyz
jhccowholesale.com
bielefeldgebaeudereinigung.com
saintraphaelschool.com
larifaa.online
dejabrew.info
izabelaeraphael.com
granniestoneet.com
greensourceseed.com
jawaahirulhikmah.com
2lipcolours.com
ginzou.com
vestradgivning.online
atlasdublinresidence.com
bfine.xyz
decision-art.com
nicebayloans.com
pendingissue.biz
troiancircular.com
raftingtennesssee.com
autistal.xyz
purposeinplans.com
socofm.com
dafuweng0471.com
transformcoach.info
vugz.info
isabellesroom.com
kasdawerf.xyz
angelicindia.com
jmakerpumploc.com
departmen.store
kalpataruplotsariaplots.net
mosqueenarbonne.com
tititinews.com
santeoglobal.com
cornharvestdirect.com
chickensoesco.com
softelbow30.com
fuxeonfire.com
soospeter.com
lastikfiyatlari.online
northlandproshop.com
youbelongstojoy.com
asfalt-podrezkovo.store
servequin.com
heti.ink
gulfingroupinvest.com
gastries.info
spunklane.com
acompanhanteslux.com
bbti.world
juiceofjoy.com
tlaaccounting.net
2635westkaylaneprescott.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4152-138-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exedescription pid process target process PID 4964 set thread context of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exepid process 4152 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe 4152 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.2018.30304.exedescription pid process target process PID 4964 wrote to memory of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe PID 4964 wrote to memory of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe PID 4964 wrote to memory of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe PID 4964 wrote to memory of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe PID 4964 wrote to memory of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe PID 4964 wrote to memory of 4152 4964 SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.2018.30304.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4152-137-0x0000000000000000-mapping.dmp
-
memory/4152-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4152-139-0x0000000000EE0000-0x000000000122A000-memory.dmpFilesize
3.3MB
-
memory/4964-132-0x0000000000980000-0x0000000000A72000-memory.dmpFilesize
968KB
-
memory/4964-133-0x0000000005B50000-0x00000000060F4000-memory.dmpFilesize
5.6MB
-
memory/4964-134-0x0000000005480000-0x0000000005512000-memory.dmpFilesize
584KB
-
memory/4964-135-0x00000000053F0000-0x00000000053FA000-memory.dmpFilesize
40KB
-
memory/4964-136-0x00000000063E0000-0x000000000647C000-memory.dmpFilesize
624KB