Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
17-12-2021 15:13
Static task
static1
Behavioral task
behavioral1
Sample
d067f8ef819c25807e5478134c851bcf.exe
Resource
win7-en-20211208
General
-
Target
d067f8ef819c25807e5478134c851bcf.exe
-
Size
609KB
-
MD5
d067f8ef819c25807e5478134c851bcf
-
SHA1
216d152d2a403abba3da5883b0ca0a4779b1fb0c
-
SHA256
78b865f64fe5efe0edb30e932584693c69c5e5b51e4877d3db7aeb19f85d0665
-
SHA512
51e625e92efd7cea58e27b6a95154323ff8859edb71b1ad8cb65f24ec3233a973b7bfcf32d330f1e42ab97a9fe8ff85ecb768adeee207e534625d1457e12120c
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 2336 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 api.ipify.org 12 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exepid process 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe 3856 d067f8ef819c25807e5478134c851bcf.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exepid process 3856 d067f8ef819c25807e5478134c851bcf.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
d067f8ef819c25807e5478134c851bcf.exedescription pid process target process PID 3856 wrote to memory of 2336 3856 d067f8ef819c25807e5478134c851bcf.exe GetX64BTIT.exe PID 3856 wrote to memory of 2336 3856 d067f8ef819c25807e5478134c851bcf.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d067f8ef819c25807e5478134c851bcf.exe"C:\Users\Admin\AppData\Local\Temp\d067f8ef819c25807e5478134c851bcf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeMD5
b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtMD5
297604018c30e7f1e09155388ded4c3e
SHA1b69af0757b59e3eecb333c6840e2289608c0e836
SHA2564808d7fe2992fdc419a758fa271bac3d2c33891dab9121c34ef5cb4ceda0382f
SHA512f7f22d620c6d4f8560805f947de345b5991d346dd8f68f96bfa6de3c882fdb2d971e03e3d7f93658534a6deb65ebb765047f379d462ec659df2647e0b6771832
-
memory/2336-119-0x0000000000000000-mapping.dmp
-
memory/3856-115-0x0000000005447000-0x00000000054AF000-memory.dmpFilesize
416KB
-
memory/3856-116-0x0000000005280000-0x00000000053CA000-memory.dmpFilesize
1.3MB
-
memory/3856-117-0x0000000000400000-0x00000000051C1000-memory.dmpFilesize
77.8MB
-
memory/3856-118-0x0000000005730000-0x00000000057F6000-memory.dmpFilesize
792KB