Overview

overview

10

Static

static

10

Borat/BoratRat.exe

windows10-2004-x64

10

Borat/bin/Audio.dll

windows10-2004-x64

1

Borat/bin/Discord.dll

windows10-2004-x64

1

Borat/bin/Extra.dll

windows10-2004-x64

1

Borat/bin/...er.dll

windows10-2004-x64

1

Borat/bin/...er.dll

windows10-2004-x64

1

Borat/bin/Fun.dll

windows10-2004-x64

1

Borat/bin/...on.dll

windows10-2004-x64

1

Borat/bin/...er.exe

windows10-2004-x64

1

Borat/bin/Logger.dll

windows10-2004-x64

1

Borat/bin/...ib.dll

windows10-2004-x64

1

Borat/bin/...us.dll

windows10-2004-x64

1

Borat/bin/Netstat.dll

windows10-2004-x64

1

Borat/bin/Options.dll

windows10-2004-x64

1

Borat/bin/...er.dll

windows10-2004-x64

1

Borat/bin/...re.dll

windows10-2004-x64

1

Borat/bin/...ry.dll

windows10-2004-x64

1

Borat/bin/Regedit.dll

windows10-2004-x64

1

Borat/bin/...ra.dll

windows10-2004-x64

1

Borat/bin/...op.dll

windows10-2004-x64

1

Borat/bin/...xy.dll

windows10-2004-x64

1

Borat/bin/...le.dll

windows10-2004-x64

1

Borat/bin/...ry.dll

windows10-2004-x64

1

Borat/raw/Client.exe

windows10-2004-x64

1

Resubmissions

15-07-2024 07:42

240715-jjvf9aycnb 10

15-07-2024 07:37

240715-jgbw5avgjj 10

Analysis

  • max time kernel
    434s
  • max time network
    437s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-07-2024 07:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Borat/raw/Client.exe

  • Size

    56KB

  • MD5

    ffb1320290cfdce0cddbf4ef17dfe898

  • SHA1

    95f706ab3a21551d4aaebda1879af62afe503879

  • SHA256

    995ef0a042d5b5b8fa9754e7c741c59e633167f510c3dfe8bdb0373debddb24d

  • SHA512

    ca48c519ecf12917836070e6f807e13e6dbcad241d0134c5c9a6a2412567d6ae4cadcfaef9e6c76446b1a426daa57fe1fab56b505bc31f5d0bbec47e758b642b

  • SSDEEP

    768:kdiv4Kbwg2V+YV5cfADYI1WQZConqLMh0AoE7pwaambG4lRueJNNQhXIxT:k+b9sCKqLzECafbX3uoQpIxT

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Borat\raw\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Borat\raw\Client.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4276-0-0x0000000000C20000-0x0000000000C34000-memory.dmp

    Filesize

    80KB

    Download

  • memory/4276-1-0x00007FF8BCA43000-0x00007FF8BCA45000-memory.dmp

    Filesize

    8KB

    Download

  • memory/4276-2-0x00007FF8BCA40000-0x00007FF8BD501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/4276-3-0x00007FF8BCA40000-0x00007FF8BD501000-memory.dmp

    Filesize

    10.8MB

    Download