Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-02-2021 15:33
Static task
static1
Behavioral task
behavioral1
Sample
c7c0d5c274eadf534eea3203e6c026258144c68e.exe
Resource
win7v20201028
General
-
Target
c7c0d5c274eadf534eea3203e6c026258144c68e.exe
-
Size
434KB
-
MD5
0450cf37e2dd4058563f73f6ca7940e5
-
SHA1
c7c0d5c274eadf534eea3203e6c026258144c68e
-
SHA256
da767e6faf97d73997f397eae71b372a549dd6331bf8ec0ebd398ef8cfe9a47e
-
SHA512
2d48fe05f18934808609d121e2dff8596016406002f221d90154903b09b40d409f805aba51ed8801ae572f20e1005fc104d83ead4b05eeab7ea39c8063a06ef3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 1464 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exepid process 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 3 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exepid process 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exepid process 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exedescription pid process target process PID 732 wrote to memory of 1464 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe GetX64BTIT.exe PID 732 wrote to memory of 1464 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe GetX64BTIT.exe PID 732 wrote to memory of 1464 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe GetX64BTIT.exe PID 732 wrote to memory of 1464 732 c7c0d5c274eadf534eea3203e6c026258144c68e.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c0d5c274eadf534eea3203e6c026258144c68e.exe"C:\Users\Admin\AppData\Local\Temp\c7c0d5c274eadf534eea3203e6c026258144c68e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:1464
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtMD5
f9ebc1b7776ae0b130f59b6b68452140
SHA14792decb20a4719716f6dc4ff9507de8a51f98f4
SHA25670f9e16e6f323cbfd03e4b9f171ddfe42462e7fe22dfee92df3ee8af2b84cb39
SHA5120867fa9be2655f29270040f1cb35cb5c12164342639cf3ddc6f79668e3f01237405c23afab823d432669fa744f84252bed258735dba17df2f0f9d99da8951d56
-
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
memory/732-2-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB
-
memory/1464-4-0x0000000000000000-mapping.dmp