Resubmissions

20-11-2024 06:32

241120-har44axpcr 10

19-11-2024 20:25

241119-y69xsasala 10

Analysis

  • max time kernel
    135s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 20:25

General

  • Target

    sqx.dll

  • Size

    1.3MB

  • MD5

    dd862590d9e4ea1791df147912ae4c8f

  • SHA1

    852d7a9ea4db5ff4cd51a92447a8d5701cfb322b

  • SHA256

    14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184

  • SHA512

    3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568

  • SSDEEP

    24576:pQrDp6J8JM3IgVvF7EtPCo1Frk5fRJhqYEjTvpAbHT0HRZonw4by:pQpI8JM3IwEtPCo1F45fvhq/jTyb4HR+

Score
10/10

Malware Config

Signatures

  • Brute Ratel C4

    A customized command and control framework for red teaming and adversary simulation.

  • Bruteratel family
  • Detect BruteRatel badger 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\sqx.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1732-9-0x0000000000120000-0x000000000015E000-memory.dmp

    Filesize

    248KB

  • memory/1732-0-0x00000000004E0000-0x000000000052C000-memory.dmp

    Filesize

    304KB

  • memory/1732-23-0x00000000004E0000-0x000000000052C000-memory.dmp

    Filesize

    304KB