Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10 -
submitted
16-09-2020 07:31
Static task
static1
Behavioral task
behavioral1
Sample
Data Analytics Services Consulting Pte. Ltd.exe
Resource
win7v200722
0 signatures
0 seconds
General
-
Target
Data Analytics Services Consulting Pte. Ltd.exe
-
Size
1.5MB
-
MD5
53a9319f71e5c132dc2ec045908f627d
-
SHA1
a5a3904a9e99bb8a1d637a4d60163ebedcc85ffc
-
SHA256
821f5310b1730641b6578ac9ce0173802db407192afdb30039f941df1ff8f1c2
-
SHA512
8f26e1ac756f4c67db83228b7a9647b7edd3d9614a45829e1a413603758e5272dca861af616397be2b737085c694d88ad729dc7ab3f512c138f70d15ee36e30f
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cmd.exeGetX64BTIT.exepid process 1960 cmd.exe 2636 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 18 api.ipify.org 17 api.ipify.org -
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\svm.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 204 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 6936 IoCs
Processes:
Data Analytics Services Consulting Pte. Ltd.exeipconfig.execmd.exepid process 1756 Data Analytics Services Consulting Pte. Ltd.exe 204 ipconfig.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe 1960 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ipconfig.exepid process 204 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 1960 cmd.exe -
Suspicious use of WriteProcessMemory 161 IoCs
Processes:
Data Analytics Services Consulting Pte. Ltd.exedescription pid process target process PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe PID 1756 wrote to memory of 204 1756 Data Analytics Services Consulting Pte. Ltd.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Data Analytics Services Consulting Pte. Ltd.exe"C:\Users\Admin\AppData\Local\Temp\Data Analytics Services Consulting Pte. Ltd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txt
-
memory/204-0-0x0000000000000000-mapping.dmp
-
memory/204-1-0x0000000006840000-0x00000000068C2000-memory.dmpFilesize
520KB
-
memory/204-2-0x0000000006EA0000-0x0000000006F3F000-memory.dmpFilesize
636KB
-
memory/1960-3-0x0000000000000000-mapping.dmp
-
memory/1960-5-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2636-6-0x0000000000000000-mapping.dmp