Analysis
-
max time kernel
1177s -
max time network
1177s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 08:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
apptext.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
1200 seconds
Behavioral task
behavioral2
Sample
apptext.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
5 signatures
1200 seconds
General
-
Target
apptext.dll
-
Size
1.6MB
-
MD5
86b57c9deafed093d4b47b03823b4d14
-
SHA1
47947da463dd6f4ecf61ae960235a35144e903a8
-
SHA256
f8e3eef1fda5969a7aabcc8fb5cc9f5fe245bbf6cc8e480459977b8e91eab9bd
-
SHA512
5f855ed0a3ecf561c45608d7f4579d6e4b1f1953863e97e0b5fea1f33b38d0e03fef16207d88864d2d936a4e65b677cd259ec248dbf06447b50f9e0488acead3
-
SSDEEP
24576:M7u7nB/DBD9accSqVO9y/QaDC4F3Zuk5UDJjbDE2W4VO8I/nYY:My/DBD9MVO9yosHF395UlbDBw82nB
Score
10/10
Malware Config
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 1 IoCs
resource yara_rule behavioral1/memory/2380-0-0x00000000003C0000-0x00000000003FE000-memory.dmp family_bruteratel -
Blocklisted process makes network request 42 IoCs
flow pid Process 5 2380 rundll32.exe 7 2380 rundll32.exe 9 2380 rundll32.exe 11 2380 rundll32.exe 13 2380 rundll32.exe 15 2380 rundll32.exe 17 2380 rundll32.exe 19 2380 rundll32.exe 29 2380 rundll32.exe 31 2380 rundll32.exe 32 2380 rundll32.exe 33 2380 rundll32.exe 34 2380 rundll32.exe 35 2380 rundll32.exe 36 2380 rundll32.exe 37 2380 rundll32.exe 38 2380 rundll32.exe 39 2380 rundll32.exe 40 2380 rundll32.exe 41 2380 rundll32.exe 42 2380 rundll32.exe 43 2380 rundll32.exe 44 2380 rundll32.exe 45 2380 rundll32.exe 46 2380 rundll32.exe 47 2380 rundll32.exe 48 2380 rundll32.exe 50 2380 rundll32.exe 51 2380 rundll32.exe 52 2380 rundll32.exe 53 2380 rundll32.exe 54 2380 rundll32.exe 55 2380 rundll32.exe 56 2380 rundll32.exe 57 2380 rundll32.exe 58 2380 rundll32.exe 61 2380 rundll32.exe 62 2380 rundll32.exe 63 2380 rundll32.exe 64 2380 rundll32.exe 65 2380 rundll32.exe 66 2380 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 rundll32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b