Analysis
- max time kernel
159s - max time network
154s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/09/2021, 13:19
Static task
static1
Behavioral task
behavioral1
Sample
81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe
- Size 1.2MB
- Sample210922-qkjvgacgd2
- SHA256 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb
- MD5 a1f481baa8334ad8a5c65919af2b6346
- SHA1 aec7cd3a72d96948bf741bba48048c1b5cf3f036
- SHA512 e0c28dabe65224c2a40612e18807dc7ccdb58168be304f38f625936b1ebbdf1a6233f6e8f3d3a676e9c82ae3d9e6477cdeac8299c670ae3676b3ca4c3fc434a8
- MD5 SHA1 SHA512
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3044 GetX64BTIT.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 api.ipify.org 9 api.ipify.org - Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2616 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 70 PID 2284 wrote to memory of 2616 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 70 PID 2284 wrote to memory of 3044 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 71 PID 2284 wrote to memory of 3044 2284 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\windows\hh.exe"C:\windows\hh.exe"2⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:3044
-