Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
148s -
max time network
277s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
18-04-2024 08:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240412-en
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cmd.execmd.exepid process 2184 cmd.exe 4568 cmd.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2304 4568 WerFault.exe cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 5052 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SecuriteInfo.com.BackDoor.Rat.281.18292.exeipconfig.exepid process 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 5052 ipconfig.exe 5052 ipconfig.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ipconfig.exepid process 5052 ipconfig.exe 5052 ipconfig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.BackDoor.Rat.281.18292.exedescription pid process target process PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 3808 wrote to memory of 5052 3808 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
PID:4568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 1684⤵
- Program crash
PID:2304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 45681⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeFilesize
245KB
MD53e59fcaf01b0f2a33d25aca69aa6bc5b
SHA1a61f6a51e1f393d596010d0a13ec415aa8346427
SHA256f7e7b369570438578e6988abe90b26568773e967696979aac8fb72303f149126
SHA512a7a59331875813318c58878fec0fbbb3b34f22b92dc904f88108e7e27a29e77ec10708b5c16fd4df7a5bd168baf5881f802678e7d54a5cb72677f7fb3ef4b758
-
memory/3808-3-0x0000000000400000-0x000000000056D000-memory.dmpFilesize
1.4MB
-
memory/3808-0-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/3808-5-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/3808-18-0x0000000002570000-0x0000000002579000-memory.dmpFilesize
36KB
-
memory/3808-1-0x0000000002570000-0x0000000002579000-memory.dmpFilesize
36KB
-
memory/4568-29-0x000000007743A000-0x000000007743B000-memory.dmpFilesize
4KB
-
memory/4568-30-0x00007FFAE4AA0000-0x00007FFAE4CA9000-memory.dmpFilesize
2.0MB
-
memory/5052-2-0x0000000000970000-0x0000000000972000-memory.dmpFilesize
8KB
-
memory/5052-19-0x0000000002F50000-0x0000000002F58000-memory.dmpFilesize
32KB
-
memory/5052-20-0x0000000004A60000-0x0000000004AE2000-memory.dmpFilesize
520KB
-
memory/5052-21-0x00007FFAE4AA0000-0x00007FFAE4CA9000-memory.dmpFilesize
2.0MB
-
memory/5052-33-0x0000000004A60000-0x0000000004AE2000-memory.dmpFilesize
520KB