Overview

overview

10

Static

static

10

ItroublveTSC.exe

windows10-2004-x64

7

bin/Binari...rv.exe

windows10-2004-x64

9

bin/obf/CLI.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    35s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2023, 04:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bin/Binaries/RtkBtManServ.exe

  • Size

    4.4MB

  • MD5

    3405f654559010ca2ae38d786389f0f1

  • SHA1

    8ac5552c64dfc3ccf0c678f6f946ee23719cf43d

  • SHA256

    bc1364d8e68f515f9f35a6b41c11a649b1f514302eb01812c68c9a95a3198b30

  • SHA512

    cb1e5ffed2ab86502ea4236383e9a4211a14b1abda13babbcceea67700c5746b37b4da6e45e10196eb76fa1e6959e71f19c6827466a54df1d5ba5ad2e16fc05b

  • SSDEEP

    98304:lQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDv:ozUcwti7TQlF3ZxxWJSUnDv

Score
9/10

Malware Config

Signatures

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 1 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bin\Binaries\RtkBtManServ.exe
    "C:\Users\Admin\AppData\Local\Temp\bin\Binaries\RtkBtManServ.exe"
    1⤵
      PID:3600
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 896
        2⤵
        • Program crash
        PID:4392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3600 -ip 3600
      1⤵
        PID:4312

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3600-133-0x00000000744A0000-0x0000000074C50000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/3600-134-0x0000000000280000-0x00000000006FA000-memory.dmp

        Filesize

        4.5MB

        Download

      • memory/3600-135-0x0000000005160000-0x0000000005170000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3600-136-0x0000000005770000-0x0000000005D14000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/3600-137-0x0000000005240000-0x00000000052B6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/3600-165-0x00000000744A0000-0x0000000074C50000-memory.dmp

        Filesize

        7.7MB

        Download