Analysis
-
max time kernel
133s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-02-2025 20:52
General
-
Target
26b519786c62293ca6fa12347a66228efb4de2eaade2609f69d34a821f0cf594.exe
-
Size
261KB
-
MD5
fac1cc5f820141ec14629225eb9a49f1
-
SHA1
3ad4a0edcd74605ce8cbb346e559038de0b76820
-
SHA256
26b519786c62293ca6fa12347a66228efb4de2eaade2609f69d34a821f0cf594
-
SHA512
3aa77b5b2a9e279329dd6de391af445c6f295e764f2a86a0fb5ec5024a10467c25dc1f1b0d54af12f9ec8faa2b710a8ce7185969ca2139103e2b2fd78e9462a9
-
SSDEEP
6144:FrSwniqL48g03KvWiNx7/3n0u8Z0E0U0Y7O1wmYwL:h1niqL48gwKOi7n0u8Z0E0jaC/
Malware Config
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 2 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 19 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\26b519786c62293ca6fa12347a66228efb4de2eaade2609f69d34a821f0cf594.exe"C:\Users\Admin\AppData\Local\Temp\26b519786c62293ca6fa12347a66228efb4de2eaade2609f69d34a821f0cf594.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4441⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB