bruteratel | bf8f2a84e39dbb6ad8905bb8e6d8650c602c95231c3e6b592c2d27d00fa6dded

Analysis

max time kernel
151s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54b68742a9e0b9704dce48b77f4aef94.exe
Size

3.9MB
MD5

54b68742a9e0b9704dce48b77f4aef94
SHA1

fd8d4a50adf32ac1ea43c546ca298255937a8c30
SHA256

bf8f2a84e39dbb6ad8905bb8e6d8650c602c95231c3e6b592c2d27d00fa6dded
SHA512

10f374198f2071969f53f5ea14963ab309ac370ad2c19bdeead83e551696408dc6949ba624203e0c984d88212914813af4dc6bbcd42acaf8df1bea203928fb2b
SSDEEP

24576:VRVOLJ0yUiRvb5aeiuLqShpsbM2bYSO/trD28:VtEb4a+a

Score

10^/10

bruteratel backdoor persistence

Malware Config

Signatures

Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\dark = "C:\\Windows\\krn2.exe"	54b68742a9e0b9704dce48b77f4aef94.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\code\ID	54b68742a9e0b9704dce48b77f4aef94.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2516	54b68742a9e0b9704dce48b77f4aef94.exe
2516	54b68742a9e0b9704dce48b77f4aef94.exe

C:\Users\Admin\AppData\Local\Temp\54b68742a9e0b9704dce48b77f4aef94.exe
"C:\Users\Admin\AppData\Local\Temp\54b68742a9e0b9704dce48b77f4aef94.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2516-0-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2516-2-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2516-3-0x0000000000400000-0x00000000007E9000-memory.dmp

Filesize
3.9MB

Download
memory/2516-4-0x0000000000400000-0x00000000007E9000-memory.dmp

Filesize
3.9MB

Download
memory/2516-5-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads