Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
148s -
max time network
277s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-04-2024 08:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win11-20240412-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
300 seconds
Behavioral task
behavioral4
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2184 cmd.exe 4568 cmd.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2304 4568 WerFault.exe 86 -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 5052 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 5052 ipconfig.exe 5052 ipconfig.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 5052 ipconfig.exe 5052 ipconfig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81 PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 1684⤵
- Program crash
PID:2304
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 45681⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD53e59fcaf01b0f2a33d25aca69aa6bc5b
SHA1a61f6a51e1f393d596010d0a13ec415aa8346427
SHA256f7e7b369570438578e6988abe90b26568773e967696979aac8fb72303f149126
SHA512a7a59331875813318c58878fec0fbbb3b34f22b92dc904f88108e7e27a29e77ec10708b5c16fd4df7a5bd168baf5881f802678e7d54a5cb72677f7fb3ef4b758