e4b6ffbd9a7484dd39aaca1d71663ee8cc3875657cd2f0de3bceaa02ba982d50 | Triage

Analysis

max time kernel
117s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2023, 21:48

Sharing

Report Analysis Logs

General

Target

BitRAT/data/tor/libssp-0.dll
Size

262KB
MD5

b1a9a0def34f550003c88212af8059a3
SHA1

4a278fbea710e2bd74124ee6be0cb0556d8d72b8
SHA256

96ae486b556532c5132e82c23fde334c044e84791e362b21bc0fb31c6b02bf08
SHA512

8742a553189711e06d28c2f9eac9aae8d931e67551391dfe58647457f8d868d52136e842ac9a7780ebd91489d2ce0695bbca0ab71829fc7f7d26d85b1f50aeec
SSDEEP

6144:EI1aC18GTMzKCbDJ9iy6YexClmZMyzbU6guuU9qepp:ocjKDJ097UYZ9gNvU

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3388	4128	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4128	1944	rundll32.exe	85
PID 1944 wrote to memory of 4128	1944	rundll32.exe	85
PID 1944 wrote to memory of 4128	1944	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BitRAT\data\tor\libssp-0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\BitRAT\data\tor\libssp-0.dll,#1
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 648
    3⤵
    - Program crash
    PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4128 -ip 4128
1⤵
PID:3736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4128-133-0x0000000075600000-0x0000000075646000-memory.dmp

Filesize
280KB

Download