Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-06-2021 12:53
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe
Resource
win7v20210410
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
cmd.execmd.execmd.exeGetX64BTIT.exe510444970.exepid process 584 cmd.exe 1112 cmd.exe 1212 cmd.exe 2616 GetX64BTIT.exe 2816 510444970.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 api.ipify.org 24 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\lvp.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3672 ipconfig.exe -
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exeipconfig.execmd.exepid process 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe 3672 ipconfig.exe 3672 ipconfig.exe 3672 ipconfig.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe 1212 cmd.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
ipconfig.exepid process 3672 ipconfig.exe 3672 ipconfig.exe 3672 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 1212 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exedescription pid process target process PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe PID 4656 wrote to memory of 3672 4656 SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.12946.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\{AEDEC3D3-6110-41C9-BC67-E9768EA9622E}\510444970.exe"510444970.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeMD5
50b930137463b14f73186c7c6767a2aa
SHA1574f512a44097275658f9c304ef0b74029e9ea46
SHA256eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9
SHA5127f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeMD5
50b930137463b14f73186c7c6767a2aa
SHA1574f512a44097275658f9c304ef0b74029e9ea46
SHA256eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9
SHA5127f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeMD5
50b930137463b14f73186c7c6767a2aa
SHA1574f512a44097275658f9c304ef0b74029e9ea46
SHA256eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9
SHA5127f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtMD5
ec888cad8982b6a4631d994b9354f0bd
SHA1a130cf9aa722b0bf9d05b338ee9d6846d002d90c
SHA256d74ef394fc4aac12da6ef40aff47cad70de69fb593cb289beaca6e29604c1851
SHA512af625d6cab61714c8340307e85f64c1c2af85389158c0ad95aec14997416b8e0255b52930414deb6b2287cb08845e51924b5ec3f56a64382f21eada9c08d2ccd
-
C:\Users\Admin\AppData\Local\Temp\{AEDEC3D3-6110-41C9-BC67-E9768EA9622E}\510444970.exeMD5
9f385a9a69a4d9e18055743f0694976b
SHA12c2385ea964a33f803e96e364d4a05771c733921
SHA25645f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c
-
C:\Users\Admin\AppData\Local\Temp\{AEDEC3D3-6110-41C9-BC67-E9768EA9622E}\510444970.exeMD5
9f385a9a69a4d9e18055743f0694976b
SHA12c2385ea964a33f803e96e364d4a05771c733921
SHA25645f175bc165a3f8d9a05da48bdc4c1f234386588e0d003df094f72d019ae6216
SHA512e9e78eb02bad22815648723138a7443da527779644ad9f9e776f91ba796b255c7556c5fe82ea526825c23ea376ed90d4dd5f31b026d2ff00605d8db9b0729c3c
-
memory/1212-168-0x00007FFA78471000-0x00007FFA7857E7A3-memory.dmpFilesize
1.1MB
-
memory/1212-154-0x0000000000000000-mapping.dmp
-
memory/1212-162-0x0000000003010000-0x0000000003017000-memory.dmpFilesize
28KB
-
memory/1212-163-0x00007FFA78470000-0x00007FFA7864B000-memory.dmpFilesize
1.9MB
-
memory/1212-191-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2616-188-0x0000000000000000-mapping.dmp
-
memory/2816-193-0x0000000000000000-mapping.dmp
-
memory/3672-116-0x0000000077639000-0x0000000077639005-memory.dmpFilesize
5B
-
memory/3672-115-0x0000000000000000-mapping.dmp
-
memory/3672-138-0x0000000004E10000-0x0000000004E18000-memory.dmpFilesize
32KB
-
memory/3672-121-0x00000000029C0000-0x00000000029C2000-memory.dmpFilesize
8KB
-
memory/3672-139-0x00007FFA78470000-0x00007FFA7864B000-memory.dmpFilesize
1.9MB
-
memory/4656-114-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/4656-120-0x00000000024D0000-0x00000000024D9000-memory.dmpFilesize
36KB