bruteratel | 14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184 | Triage

Resubmissions

30-11-2024 00:13

241130-ahvwystmfv 10

29-11-2024 21:13

241129-z2qtsa1lhn 10

27-11-2024 19:30

241127-x7tfratjar 10

27-11-2024 19:27

241127-x6eafawrbz 10

26-11-2024 23:43

241126-3qkp6sslfn 10

Analysis

max time kernel
20s
max time network
29s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 19:27

Sharing

Report Analysis Logs

General

Target

sqx.dll
Size

1.3MB
MD5

dd862590d9e4ea1791df147912ae4c8f
SHA1

852d7a9ea4db5ff4cd51a92447a8d5701cfb322b
SHA256

14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184
SHA512

3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568
SSDEEP

24576:pQrDp6J8JM3IgVvF7EtPCo1Frk5fRJhqYEjTvpAbHT0HRZonw4by:pQpI8JM3IwEtPCo1F45fvhq/jTyb4HR+

Score

10^/10

bruteratel backdoor

Malware Config

Signatures

Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
backdoor bruteratel
Bruteratel family
bruteratel

Detect BruteRatel badger 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2556-9-0x00000000001B0000-0x00000000001EE000-memory.dmp	family_bruteratel

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid	Process
2556	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sqx.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2556-9-0x00000000001B0000-0x00000000001EE000-memory.dmp

Filesize
248KB

Download
memory/2556-0-0x00000000001F0000-0x000000000023C000-memory.dmp

Filesize
304KB

Download
memory/2556-10-0x00000000001F0000-0x000000000023C000-memory.dmp

Filesize
304KB

Download