Resubmissions

17/07/2025, 09:10

250717-k5g9gsbp7t 10

21/02/2025, 15:06

250221-sgsz3stncz 8

Analysis

  • max time kernel
    149s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • submitted
    21/02/2025, 15:06

General

  • Target

    SecuriteInfo.com.BackDoor.BXRatNET.1.23700.25706.dll

  • Size

    636KB

  • MD5

    70d771de80d4eb91ea1fb57afac54335

  • SHA1

    dc9912acc86ff6053f342ab62546e235e4fced70

  • SHA256

    57782ee01eda25c747e35f98eeab417cb9eb47c6bfff7c77a18e4edb063623ae

  • SHA512

    0374ef0c0b72d8bbdc164222105cc1a4f56866e06cd47c1eaf2119653367b18cf192587dd22afc08ddb20dbe7de23961a14a386c0f521ac17fa5818f433fc605

  • SSDEEP

    6144:uVfEtVeCR1EAXHt/GA7gTrCd3jNgmuZTQTdSmkBiLSbdUQXbo+HGt4m/:uVfEn6QHt/P8C3jcmTI93cn/

Score
10/10

Malware Config

Signatures

  • Detect JanelaRAT payload 2 IoCs
  • JanelaRAT

    JanelaRAT is a trojan targeting FinTech users in the LATAM region written in C#.

  • Janelarat family
  • Blocklisted process makes network request 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.BXRatNET.1.23700.25706.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1840

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1840-0-0x0000026C022B0000-0x0000026C022C0000-memory.dmp

          Filesize

          64KB

        • memory/1840-1-0x00007FFF5CDB3000-0x00007FFF5CDB5000-memory.dmp

          Filesize

          8KB

        • memory/1840-2-0x0000000000E20000-0x0000000000EC8000-memory.dmp

          Filesize

          672KB

        • memory/1840-3-0x000000005F270000-0x000000005F318000-memory.dmp

          Filesize

          672KB

        • memory/1840-4-0x0000026C022B0000-0x0000026C022C0000-memory.dmp

          Filesize

          64KB

        • memory/1840-5-0x00007FFF5CDB3000-0x00007FFF5CDB5000-memory.dmp

          Filesize

          8KB