Analysis

  • max time kernel
    121s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2024 11:22

General

  • Target

    714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347.dll

  • Size

    1.9MB

  • MD5

    33fe5e2d127a35797c7086a0d1ff1102

  • SHA1

    b6c6a5396a23b1aee2e5bac94eff70822f59b125

  • SHA256

    714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347

  • SHA512

    7882fbb011fe4c0ca12491d2cde92090a512944d6eebbeedc10e05bde07bdd87359b1c28941b50b6bebc5416215931e67e178fe2ee7e6013d9d58a5fae459930

  • SSDEEP

    24576:2g7GfSjvBt2ptVDe6jKBNu9+oyOjTCXM79Keh6ykUEPP3:2g7OSNkw7CEoyuuXmUehjkUS

Score
10/10

Malware Config

Signatures

  • Brute Ratel C4

    A customized command and control framework for red teaming and adversary simulation.

  • Bruteratel family
  • Detect BruteRatel badger 1 IoCs
  • Blocklisted process makes network request 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4880-0-0x000001C45AFB0000-0x000001C45AFEE000-memory.dmp

    Filesize

    248KB

  • memory/4880-1-0x000001C45AFF0000-0x000001C45B03C000-memory.dmp

    Filesize

    304KB

  • memory/4880-10-0x000001C45AFB0000-0x000001C45AFEE000-memory.dmp

    Filesize

    248KB

  • memory/4880-29-0x000001C45AFF0000-0x000001C45B03C000-memory.dmp

    Filesize

    304KB