Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 08:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3616 4016 WerFault.exe 92 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4016 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92 PID 468 wrote to memory of 4016 468 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
PID:4016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1443⤵
- Program crash
PID:3616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4016 -ip 40161⤵PID:4380
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3628 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵PID:4708