Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347.dll
Resource
win10v2004-20241007-en
General
-
Target
714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347.dll
-
Size
1.9MB
-
MD5
33fe5e2d127a35797c7086a0d1ff1102
-
SHA1
b6c6a5396a23b1aee2e5bac94eff70822f59b125
-
SHA256
714944899f2b0fe6496ac15359ba90fb9d9891a84111fc7dc3cd5b1093b17347
-
SHA512
7882fbb011fe4c0ca12491d2cde92090a512944d6eebbeedc10e05bde07bdd87359b1c28941b50b6bebc5416215931e67e178fe2ee7e6013d9d58a5fae459930
-
SSDEEP
24576:2g7GfSjvBt2ptVDe6jKBNu9+oyOjTCXM79Keh6ykUEPP3:2g7OSNkw7CEoyuuXmUehjkUS
Malware Config
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4880-10-0x000001C45AFB0000-0x000001C45AFEE000-memory.dmp family_bruteratel -
Blocklisted process makes network request 11 IoCs
Processes:
rundll32.exeflow pid Process 15 4880 rundll32.exe 17 4880 rundll32.exe 19 4880 rundll32.exe 24 4880 rundll32.exe 26 4880 rundll32.exe 28 4880 rundll32.exe 30 4880 rundll32.exe 34 4880 rundll32.exe 57 4880 rundll32.exe 63 4880 rundll32.exe 65 4880 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
rundll32.exepid Process 4880 rundll32.exe 4880 rundll32.exe 4880 rundll32.exe 4880 rundll32.exe 4880 rundll32.exe 4880 rundll32.exe