Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17-12-2021 15:13
Static task
static1
Behavioral task
behavioral1
Sample
d067f8ef819c25807e5478134c851bcf.exe
Resource
win7-en-20211208
General
-
Target
d067f8ef819c25807e5478134c851bcf.exe
-
Size
609KB
-
MD5
d067f8ef819c25807e5478134c851bcf
-
SHA1
216d152d2a403abba3da5883b0ca0a4779b1fb0c
-
SHA256
78b865f64fe5efe0edb30e932584693c69c5e5b51e4877d3db7aeb19f85d0665
-
SHA512
51e625e92efd7cea58e27b6a95154323ff8859edb71b1ad8cb65f24ec3233a973b7bfcf32d330f1e42ab97a9fe8ff85ecb768adeee207e534625d1457e12120c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 1920 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exepid process 748 d067f8ef819c25807e5478134c851bcf.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org 4 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exepid process 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe 748 d067f8ef819c25807e5478134c851bcf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exepid process 748 d067f8ef819c25807e5478134c851bcf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exedescription pid process target process PID 748 wrote to memory of 1920 748 d067f8ef819c25807e5478134c851bcf.exe GetX64BTIT.exe PID 748 wrote to memory of 1920 748 d067f8ef819c25807e5478134c851bcf.exe GetX64BTIT.exe PID 748 wrote to memory of 1920 748 d067f8ef819c25807e5478134c851bcf.exe GetX64BTIT.exe PID 748 wrote to memory of 1920 748 d067f8ef819c25807e5478134c851bcf.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d067f8ef819c25807e5478134c851bcf.exe"C:\Users\Admin\AppData\Local\Temp\d067f8ef819c25807e5478134c851bcf.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtMD5
1a5d97b6f9236cce64581add132bec0d
SHA1252f2f21f9732d9ca5dff81d05df1625d8a3bf57
SHA256aab320c09bfae0cc4d0f88014cb583266439be38ec3f5155c57ae4d78535db44
SHA512da41c30fed016c892d64b704df24181897edbe84c99971ab3591723cec632dc16437e527a7495c11840a94568eca88e23ab5d3ebf871cab3ebd155ee06ea00ea
-
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
memory/748-53-0x0000000005309000-0x0000000005370000-memory.dmpFilesize
412KB
-
memory/748-54-0x0000000000260000-0x00000000002C7000-memory.dmpFilesize
412KB
-
memory/748-55-0x0000000000400000-0x00000000051C1000-memory.dmpFilesize
77.8MB
-
memory/748-56-0x00000000754B1000-0x00000000754B3000-memory.dmpFilesize
8KB
-
memory/748-57-0x00000000051D0000-0x0000000005296000-memory.dmpFilesize
792KB
-
memory/748-62-0x0000000010000000-0x0000000010016000-memory.dmpFilesize
88KB
-
memory/748-63-0x00000000003D0000-0x00000000003EF000-memory.dmpFilesize
124KB
-
memory/1920-59-0x0000000000000000-mapping.dmp