Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
16-09-2020 07:31
Static task
static1
Behavioral task
behavioral1
Sample
Data Analytics Services Consulting Pte. Ltd.exe
Resource
win7v200722
General
-
Target
Data Analytics Services Consulting Pte. Ltd.exe
-
Size
1.5MB
-
MD5
53a9319f71e5c132dc2ec045908f627d
-
SHA1
a5a3904a9e99bb8a1d637a4d60163ebedcc85ffc
-
SHA256
821f5310b1730641b6578ac9ce0173802db407192afdb30039f941df1ff8f1c2
-
SHA512
8f26e1ac756f4c67db83228b7a9647b7edd3d9614a45829e1a413603758e5272dca861af616397be2b737085c694d88ad729dc7ab3f512c138f70d15ee36e30f
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
cmd.execmd.execmd.execmd.exeGetX64BTIT.exepid process 2040 cmd.exe 1168 cmd.exe 1164 cmd.exe 832 cmd.exe 1432 GetX64BTIT.exe -
Loads dropped DLL 5 IoCs
Processes:
ipconfig.execmd.exepid process 1404 ipconfig.exe 1404 ipconfig.exe 1404 ipconfig.exe 1404 ipconfig.exe 832 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 api.ipify.org 13 api.ipify.org -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\svm.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1404 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1676 IoCs
Processes:
Data Analytics Services Consulting Pte. Ltd.exeipconfig.execmd.exepid process 1156 Data Analytics Services Consulting Pte. Ltd.exe 1404 ipconfig.exe 1404 ipconfig.exe 1404 ipconfig.exe 1404 ipconfig.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe 832 cmd.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
ipconfig.exepid process 1404 ipconfig.exe 1404 ipconfig.exe 1404 ipconfig.exe 1404 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 832 cmd.exe -
Suspicious use of WriteProcessMemory 115 IoCs
Processes:
Data Analytics Services Consulting Pte. Ltd.exeipconfig.exedescription pid process target process PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1156 wrote to memory of 1404 1156 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 2040 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1168 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe PID 1404 wrote to memory of 1164 1404 ipconfig.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Data Analytics Services Consulting Pte. Ltd.exe"C:\Users\Admin\AppData\Local\Temp\Data Analytics Services Consulting Pte. Ltd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Loads dropped DLL
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
-
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
-
\Users\Admin\AppData\Local\Temp\cmd.exe
-
\Users\Admin\AppData\Local\Temp\cmd.exe
-
\Users\Admin\AppData\Local\Temp\cmd.exe
-
\Users\Admin\AppData\Local\Temp\cmd.exe
-
memory/832-19-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/832-18-0x00000000001B0000-0x00000000001CF000-memory.dmpFilesize
124KB
-
memory/832-11-0x0000000000000000-mapping.dmp
-
memory/832-13-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/1360-1-0x000007FEF7620000-0x000007FEF789A000-memory.dmpFilesize
2.5MB
-
memory/1404-10-0x0000000005570000-0x000000000560F000-memory.dmpFilesize
636KB
-
memory/1404-0-0x0000000000000000-mapping.dmp
-
memory/1404-2-0x00000000042C0000-0x0000000004342000-memory.dmpFilesize
520KB
-
memory/1432-15-0x0000000000000000-mapping.dmp