Analysis
-
max time kernel
149s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 00:37
Static task
static1
Behavioral task
behavioral1
Sample
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe
Resource
win7-20220414-en
General
-
Target
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe
-
Size
811KB
-
MD5
4dde427954743432f72829b418141855
-
SHA1
2ccb255990d65d18d6be680300f9b8249092f532
-
SHA256
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565
-
SHA512
c370192e94a43fd0f4da2981395332d775be823b8fca128c95990cd9937fea28fb6ac1e1860096184cda82dc6d3e3c04fa167e6cea721bc0a459b25af05d84de
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 1752 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
Processes:
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exepid process 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exepid process 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exepid process 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exedescription pid process target process PID 1664 wrote to memory of 1752 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe GetX64BTIT.exe PID 1664 wrote to memory of 1752 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe GetX64BTIT.exe PID 1664 wrote to memory of 1752 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe GetX64BTIT.exe PID 1664 wrote to memory of 1752 1664 5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe"C:\Users\Admin\AppData\Local\Temp\5d779c5adeeea47cdfe6561bbb8c8a4a2d7e9eeab12b0482208be845be933565.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD56bc5c6c175b2594f1aa8007d2874f213
SHA1b701a960f57251d3ce8caf304bd0a8ed5a837451
SHA2561b0ad807f63e015858e61fd3964e838535ad32f7d70ad89dc31a780045d66eab
SHA5127019a680b8a9f6d4e4c0c73442f7a8fde158a7bed527070599bc891fd45c44fb197b158b1a4ef41dab26bbafe43dedfa8c68c7a870df2d42b0af51e88d580411
-
\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
memory/1664-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1664-55-0x0000000007A7D000-0x0000000007AD1000-memory.dmpFilesize
336KB
-
memory/1664-56-0x0000000000220000-0x0000000000274000-memory.dmpFilesize
336KB
-
memory/1664-57-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1664-58-0x00000000092F0000-0x000000000938F000-memory.dmpFilesize
636KB
-
memory/1664-64-0x00000000003E0000-0x00000000003FE000-memory.dmpFilesize
120KB
-
memory/1664-63-0x0000000010000000-0x0000000010015000-memory.dmpFilesize
84KB
-
memory/1752-60-0x0000000000000000-mapping.dmp