Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2024 10:24

General

  • Target

    c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll

  • Size

    724KB

  • MD5

    12d56ac4ed9cadb4f6f54c7bd7fdfeb6

  • SHA1

    c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5

  • SHA256

    c6c697d658dd221f27a8d58e79a478646877ac6afcf0cbe2ce919862f3889c6b

  • SHA512

    1a6737f4977b2a0e94498edda635cb09d1ea63ee0072fedec16f1227d99d602298e60d091fd958494b4a6b7730f8c11c670c1164ac57a8c7e7aeb98deb3390b0

  • SSDEEP

    12288:+h/M5nsxW5fFcrGn7Q21Svj07MGpmeSM6C4LWYv1AoMVPPynuJskZVjSKUCWnkoD:+rr+VPPnJs3KUCWkC3r

Score
10/10

Malware Config

Signatures

  • Brute Ratel C4

    A customized command and control framework for red teaming and adversary simulation.

  • Detect BruteRatel badger 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3439bcb0ee6d1bda33ef15a3d1d040c331e77d5.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    PID:2060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2060-0-0x0000016176890000-0x00000161768CE000-memory.dmp

    Filesize

    248KB

  • memory/2060-10-0x0000016176890000-0x00000161768CE000-memory.dmp

    Filesize

    248KB

  • memory/2060-1-0x0000016176910000-0x000001617695C000-memory.dmp

    Filesize

    304KB

  • memory/2060-11-0x0000016176910000-0x000001617695C000-memory.dmp

    Filesize

    304KB