Analysis
-
max time kernel
98s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 18:45
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
Resource
win7-20230621-en
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe
-
Size
12.2MB
-
MD5
450d8900f699a7730d0219ab789fc7b2
-
SHA1
713a63d0321c51b0c91347d407ece92d8800c0aa
-
SHA256
383e4ef893f9e4a573ba5ff801d150f2d401e7badb2d18ba47698991eb3750b1
-
SHA512
82f2046e059923c3c1be7e82af6947b7b62c5056ae60e15675103dbd911ee9b703f0537e863f782251df7ed8a1ce2d10db173055341ae8e945a4b846df7c8418
-
SSDEEP
196608:7zLA8rc2nh3bgz/KjFmRJKxwYfzBaHIGWtqfuNLPRt7WNGV/5BJOy9k0YNiE3lgq:3Lz5UTKuJKxk9WtUMXVVjYym0Yke
Malware Config
Signatures
-
DarkVNC payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1572-1075-0x0000000000400000-0x0000000000488000-memory.dmp darkvnc behavioral2/memory/2692-1077-0x0000000000C30000-0x0000000000CF9000-memory.dmp darkvnc -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.24734.17790.exeSecuriteInfo.com.Win32.RATX-gen.24734.17790.exedescription pid process target process PID 4664 set thread context of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 1572 set thread context of 2692 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.24734.17790.exepid process 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.24734.17790.exedescription pid process Token: SeDebugPrivilege 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SecuriteInfo.com.Win32.RATX-gen.24734.17790.exeSecuriteInfo.com.Win32.RATX-gen.24734.17790.exedescription pid process target process PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 4664 wrote to memory of 1572 4664 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe PID 1572 wrote to memory of 2692 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe svchost.exe PID 1572 wrote to memory of 2692 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe svchost.exe PID 1572 wrote to memory of 2692 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe svchost.exe PID 1572 wrote to memory of 2692 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe svchost.exe PID 1572 wrote to memory of 2692 1572 SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.24734.17790.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1572-1075-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/2692-1077-0x0000000000C30000-0x0000000000CF9000-memory.dmpFilesize
804KB
-
memory/2692-1076-0x0000000000D00000-0x0000000000D01000-memory.dmpFilesize
4KB
-
memory/4664-167-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-199-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-138-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-139-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-141-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-143-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-145-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-147-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-149-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-151-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-153-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-155-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-157-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-173-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-161-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-163-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-165-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-133-0x0000000000E70000-0x0000000001AB4000-memory.dmpFilesize
12.3MB
-
memory/4664-135-0x0000000006490000-0x00000000064A0000-memory.dmpFilesize
64KB
-
memory/4664-137-0x00000000076F0000-0x0000000007782000-memory.dmpFilesize
584KB
-
memory/4664-159-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-175-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-177-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-179-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-181-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-183-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-185-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-187-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-189-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-191-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-195-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-193-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-197-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-171-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-201-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-1060-0x0000000006C00000-0x0000000006C01000-memory.dmpFilesize
4KB
-
memory/4664-136-0x0000000007BF0000-0x0000000008194000-memory.dmpFilesize
5.6MB
-
memory/4664-169-0x0000000007560000-0x0000000007638000-memory.dmpFilesize
864KB
-
memory/4664-134-0x0000000006490000-0x00000000064A0000-memory.dmpFilesize
64KB