Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-01-2025 08:18

General

  • Target

    AV MP3 Player-Morpher.exe

  • Size

    433KB

  • MD5

    57fe3645106cd88eba409cfc302a9dd6

  • SHA1

    06da7a86f9b1087bd5894f7d61bf92a256b28268

  • SHA256

    7247d0170e44761845d592539ce499dbf3136bfffd4956f4c6e28d8b8e8c6a9f

  • SHA512

    f7769111e45cdee5cca717f70a66e425d0f76c4178a3f27a10858d234d4dd768d64cc733fcee268742ddb38b35b754cb2412366f0066b255935c926157109fca

  • SSDEEP

    6144:X9Xdchs2vUcEcUyYn+ccks6d/W/FI0wbyO4ymX1iGGT/8KIwJtAzWecK19oPj:ZdUUc3ZYndP/W/FI0WGXgHLIw1e/9o7

Malware Config

Signatures

  • Brute Ratel C4

    A customized command and control framework for red teaming and adversary simulation.

  • Bruteratel family
  • Detect BruteRatel badger 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AV MP3 Player-Morpher.exe
    "C:\Users\Admin\AppData\Local\Temp\AV MP3 Player-Morpher.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:5108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Avnex\AV MP3 Player-Morpher 4.0\Language.ini

    Filesize

    98B

    MD5

    a0900e88e7b6a8d2054b638426ca9533

    SHA1

    29eb0baa84449933dbec57c3657aa3906bfdc8c1

    SHA256

    b0f2ff41b36d0e1ab94d88a8d8d4bb185c100f1f7d69ae4cf12aa43adc328dbc

    SHA512

    653216462f4d7000deb136fefdc7aeca99139c8392870a6bb3d9d5500861097d7b8eb7560c5c3503b060c95747ca013a429e2f19bf66e8c7d9362e6407c88e1b

  • memory/5108-54-0x0000000003B20000-0x0000000003B41000-memory.dmp

    Filesize

    132KB

  • memory/5108-101-0x0000000003BA0000-0x0000000003BB3000-memory.dmp

    Filesize

    76KB

  • memory/5108-5-0x0000000000AF0000-0x0000000000B10000-memory.dmp

    Filesize

    128KB

  • memory/5108-3-0x0000000000AD0000-0x0000000000AE9000-memory.dmp

    Filesize

    100KB

  • memory/5108-0-0x0000000000510000-0x000000000051E000-memory.dmp

    Filesize

    56KB

  • memory/5108-7-0x0000000000B50000-0x0000000000B7B000-memory.dmp

    Filesize

    172KB

  • memory/5108-15-0x0000000003B20000-0x0000000003B3B000-memory.dmp

    Filesize

    108KB

  • memory/5108-19-0x0000000003B20000-0x0000000003B31000-memory.dmp

    Filesize

    68KB

  • memory/5108-21-0x0000000003B20000-0x0000000003B35000-memory.dmp

    Filesize

    84KB

  • memory/5108-23-0x0000000003B20000-0x0000000003B33000-memory.dmp

    Filesize

    76KB

  • memory/5108-25-0x00000000041D0000-0x0000000004222000-memory.dmp

    Filesize

    328KB

  • memory/5108-28-0x0000000003B20000-0x0000000003B32000-memory.dmp

    Filesize

    72KB

  • memory/5108-30-0x0000000003B20000-0x0000000003B33000-memory.dmp

    Filesize

    76KB

  • memory/5108-32-0x0000000003B20000-0x0000000003B35000-memory.dmp

    Filesize

    84KB

  • memory/5108-51-0x0000000003B20000-0x0000000003B50000-memory.dmp

    Filesize

    192KB

  • memory/5108-34-0x0000000003B20000-0x0000000003B32000-memory.dmp

    Filesize

    72KB

  • memory/5108-38-0x0000000003B20000-0x0000000003B33000-memory.dmp

    Filesize

    76KB

  • memory/5108-40-0x0000000003B20000-0x0000000003B38000-memory.dmp

    Filesize

    96KB

  • memory/5108-43-0x0000000003B20000-0x0000000003B34000-memory.dmp

    Filesize

    80KB

  • memory/5108-45-0x0000000003B20000-0x0000000003B32000-memory.dmp

    Filesize

    72KB

  • memory/5108-47-0x0000000003B20000-0x0000000003B49000-memory.dmp

    Filesize

    164KB

  • memory/5108-49-0x0000000003B20000-0x0000000003B42000-memory.dmp

    Filesize

    136KB

  • memory/5108-36-0x0000000003B20000-0x0000000003B33000-memory.dmp

    Filesize

    76KB

  • memory/5108-9-0x0000000000BA0000-0x0000000000BB5000-memory.dmp

    Filesize

    84KB

  • memory/5108-77-0x0000000003BA0000-0x0000000003BC6000-memory.dmp

    Filesize

    152KB

  • memory/5108-59-0x0000000003B20000-0x0000000003B46000-memory.dmp

    Filesize

    152KB

  • memory/5108-61-0x0000000003B20000-0x0000000003B42000-memory.dmp

    Filesize

    136KB

  • memory/5108-65-0x0000000003BA0000-0x0000000003BC9000-memory.dmp

    Filesize

    164KB

  • memory/5108-67-0x0000000003BA0000-0x0000000003BC2000-memory.dmp

    Filesize

    136KB

  • memory/5108-69-0x0000000003BA0000-0x0000000003BD0000-memory.dmp

    Filesize

    192KB

  • memory/5108-72-0x0000000003BA0000-0x0000000003BC1000-memory.dmp

    Filesize

    132KB

  • memory/5108-75-0x0000000003BA0000-0x0000000003BC1000-memory.dmp

    Filesize

    132KB

  • memory/5108-57-0x0000000003B20000-0x0000000003B41000-memory.dmp

    Filesize

    132KB

  • memory/5108-79-0x0000000003BA0000-0x0000000003BC2000-memory.dmp

    Filesize

    136KB

  • memory/5108-81-0x0000000003BA0000-0x0000000003BBB000-memory.dmp

    Filesize

    108KB

  • memory/5108-84-0x0000000003BA0000-0x0000000003BB1000-memory.dmp

    Filesize

    68KB

  • memory/5108-86-0x0000000003BA0000-0x0000000003BB5000-memory.dmp

    Filesize

    84KB

  • memory/5108-88-0x0000000003BA0000-0x0000000003BB3000-memory.dmp

    Filesize

    76KB

  • memory/5108-93-0x0000000003BA0000-0x0000000003BB2000-memory.dmp

    Filesize

    72KB

  • memory/5108-95-0x0000000003BA0000-0x0000000003BB3000-memory.dmp

    Filesize

    76KB

  • memory/5108-97-0x0000000003BA0000-0x0000000003BB5000-memory.dmp

    Filesize

    84KB

  • memory/5108-99-0x0000000003BA0000-0x0000000003BB2000-memory.dmp

    Filesize

    72KB

  • memory/5108-1-0x0000000000570000-0x00000000005E5000-memory.dmp

    Filesize

    468KB

  • memory/5108-103-0x0000000003BA0000-0x0000000003BB3000-memory.dmp

    Filesize

    76KB

  • memory/5108-105-0x0000000003BA0000-0x0000000003BB8000-memory.dmp

    Filesize

    96KB

  • memory/5108-108-0x0000000003BA0000-0x0000000003BB4000-memory.dmp

    Filesize

    80KB

  • memory/5108-110-0x0000000003BA0000-0x0000000003BB2000-memory.dmp

    Filesize

    72KB

  • memory/5108-115-0x00000000071E0000-0x00000000076AE000-memory.dmp

    Filesize

    4.8MB