Resubmissions
30-11-2024 00:13
241130-ahvwystmfv 1029-11-2024 21:13
241129-z2qtsa1lhn 1027-11-2024 19:30
241127-x7tfratjar 1027-11-2024 19:27
241127-x6eafawrbz 1026-11-2024 23:43
241126-3qkp6sslfn 10Analysis
-
max time kernel
50s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-11-2024 21:13
General
-
Target
sqx.dll
-
Size
1.3MB
-
MD5
dd862590d9e4ea1791df147912ae4c8f
-
SHA1
852d7a9ea4db5ff4cd51a92447a8d5701cfb322b
-
SHA256
14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184
-
SHA512
3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568
-
SSDEEP
24576:pQrDp6J8JM3IgVvF7EtPCo1Frk5fRJhqYEjTvpAbHT0HRZonw4by:pQpI8JM3IwEtPCo1F45fvhq/jTyb4HR+
Score
10/10
Malware Config
Extracted
Family
latrodectus
C2
https://reateberam.com/test/
https://dogirafer.com/test/
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 1 IoCs
-
Detects Latrodectus 3 IoCs
Detects Latrodectus v1.4.
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Blocklisted process makes network request 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqx.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
248KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
304KB