Analysis
-
max time kernel
154s -
max time network
79s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 09:27
Static task
static1
Behavioral task
behavioral1
Sample
2f50000.exe
Resource
win7v20210408
General
-
Target
2f50000.exe
-
Size
434KB
-
MD5
e2f99487e970a27006cf282abab1d49a
-
SHA1
b5d6b3b95f265888ce74e1be495858928214eb00
-
SHA256
7176b06d8ef959057db3fa2868695ee2d3e810353fb236923840903ddb47019a
-
SHA512
40e23b344272daba585c707e7e6298450049102052ae516b7b98ca0591274676cdc4e9891d149204595388b0347ed701b42b65c64901683a17c930f925a19351
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 1324 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
Processes:
2f50000.exepid process 1652 2f50000.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 3 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2f50000.exepid process 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe 1652 2f50000.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2f50000.exepid process 1652 2f50000.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2f50000.exedescription pid process target process PID 1652 wrote to memory of 1324 1652 2f50000.exe GetX64BTIT.exe PID 1652 wrote to memory of 1324 1652 2f50000.exe GetX64BTIT.exe PID 1652 wrote to memory of 1324 1652 2f50000.exe GetX64BTIT.exe PID 1652 wrote to memory of 1324 1652 2f50000.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f50000.exe"C:\Users\Admin\AppData\Local\Temp\2f50000.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:1324
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtMD5
ee04b902affb0bc26a27c936e50c2674
SHA184b32e3be5fa04b01adad4636a25e7432f1ec79e
SHA25698506dc8ef70b461743e148b5b52ca923951b71a2c32a716c6a1e13fe1606ec3
SHA5120665ac29175f30790fe6ab1b5989c43d01be40796f7ea0bc23ce1a61207a033ab449269d5198be6e9b66ff0f052fe7ec347608998b9890281bce4781c69a126e
-
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
memory/1324-62-0x0000000000000000-mapping.dmp
-
memory/1652-60-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB