Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3396 cmd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2676 3396 WerFault.exe 103 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2028 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 2028 ipconfig.exe 2028 ipconfig.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2028 ipconfig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91 PID 1804 wrote to memory of 2028 1804 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
PID:3396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 1564⤵
- Program crash
PID:2676
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3396 -ip 33961⤵PID:2592
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:3552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2