Analysis
-
max time kernel
65s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-02-2021 15:33
Static task
static1
Behavioral task
behavioral1
Sample
c7c0d5c274eadf534eea3203e6c026258144c68e.exe
Resource
win7v20201028
General
-
Target
c7c0d5c274eadf534eea3203e6c026258144c68e.exe
-
Size
434KB
-
MD5
0450cf37e2dd4058563f73f6ca7940e5
-
SHA1
c7c0d5c274eadf534eea3203e6c026258144c68e
-
SHA256
da767e6faf97d73997f397eae71b372a549dd6331bf8ec0ebd398ef8cfe9a47e
-
SHA512
2d48fe05f18934808609d121e2dff8596016406002f221d90154903b09b40d409f805aba51ed8801ae572f20e1005fc104d83ead4b05eeab7ea39c8063a06ef3
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
GetX64BTIT.exe1621222759.exepid process 2464 GetX64BTIT.exe 3292 1621222759.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.ipify.org 11 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1164 4092 WerFault.exe c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exepid process 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 1164 WerFault.exe Token: SeBackupPrivilege 1164 WerFault.exe Token: SeDebugPrivilege 1164 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exepid process 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c7c0d5c274eadf534eea3203e6c026258144c68e.exedescription pid process target process PID 4092 wrote to memory of 2464 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe GetX64BTIT.exe PID 4092 wrote to memory of 2464 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe GetX64BTIT.exe PID 4092 wrote to memory of 3292 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 1621222759.exe PID 4092 wrote to memory of 3292 4092 c7c0d5c274eadf534eea3203e6c026258144c68e.exe 1621222759.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c0d5c274eadf534eea3203e6c026258144c68e.exe"C:\Users\Admin\AppData\Local\Temp\c7c0d5c274eadf534eea3203e6c026258144c68e.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\{3BD5DEEE-4B67-4997-9BE5-608480F9EE8B}\1621222759.exe"1621222759.exe"2⤵
- Executes dropped EXE
PID:3292 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 11242⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1164
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtMD5
a742ab998f10bc57fefced9174d4f4f5
SHA17deca2a2f7a5dda43cc429d84ec68d6dc34edcb6
SHA2563f050f8f9cdde50075e189c6f7a76508f3b9585ec7025974221fe893d4c8ae03
SHA512415fb9e5e69dd38eb59deba84863671643717d0a12b0a1dc9a1ced38dabf01dff63b0a4ef4d3ab20305bc865deb73c174fde61616513328fbb41b401e8742ec1
-
C:\Users\Admin\AppData\Local\Temp\{3BD5DEEE-4B67-4997-9BE5-608480F9EE8B}\1621222759.exeMD5
9f385a9a69a4d9e18055743f0694976b
SHA12c2385ea964a33f803e96e364d4a05771c733921
SHA25645f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c
-
C:\Users\Admin\AppData\Local\Temp\{3BD5DEEE-4B67-4997-9BE5-608480F9EE8B}\1621222759.exeMD5
9f385a9a69a4d9e18055743f0694976b
SHA12c2385ea964a33f803e96e364d4a05771c733921
SHA25645f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c
-
memory/1164-9-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/2464-2-0x0000000000000000-mapping.dmp
-
memory/3292-6-0x0000000000000000-mapping.dmp