Analysis
-
max time kernel
171s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-06-2022 18:13
Static task
static1
Behavioral task
behavioral1
Sample
3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe
Resource
win7-20220414-en
General
-
Target
3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe
-
Size
812KB
-
MD5
9de6099c8ff65db0bfea060cdf8cce74
-
SHA1
e370e6cc97c9be6abf41c142ab69699833488b72
-
SHA256
3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8
-
SHA512
a5c518d53366aa467436c2f02972903d43a988acb6e1d647b49bb949c04b1f316b7eb4c34736b96ae82f5f6262b2b2288556e2b24009df1d9e634a6bbf073f61
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 3856 GetX64BTIT.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 api.ipify.org -
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4352 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 4516 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 4040 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 764 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 1388 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3676 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 912 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 1532 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 1004 3424 WerFault.exe 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exepid process 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exepid process 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exedescription pid process target process PID 3424 wrote to memory of 3856 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe GetX64BTIT.exe PID 3424 wrote to memory of 3856 3424 3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe"C:\Users\Admin\AppData\Local\Temp\3547550900d39131e5f670560072fc4a4314bf3a7b7757c3b3c2fb315b70d9a8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 5402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 5802⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 6042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 6682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 7282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 7282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 8642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 10162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 9122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3424 -ip 34241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3424 -ip 34241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD5116aa9bfdf47d839ae9b7df0bc407a1e
SHA14a06a359047d8ea5aff38e94a0cfe62f343059a5
SHA25653df34ec58e12ad2fd04bf0ecde062120776c6cdf234bdf9665cc74b42941022
SHA5125671eba95c7420d4ab218674011c37cbb320dae9bc7b12c746374a9bf96fd49b7edfe3425fd366e23823f784053fb532aa8ec1bbe64c20024e33725d4fde9e93
-
memory/3424-130-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3424-131-0x0000000007A5B000-0x0000000007AAF000-memory.dmpFilesize
336KB
-
memory/3424-132-0x0000000009840000-0x0000000009894000-memory.dmpFilesize
336KB
-
memory/3424-133-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/3424-134-0x00000000098A0000-0x000000000993F000-memory.dmpFilesize
636KB
-
memory/3424-135-0x0000000007A5B000-0x0000000007AAF000-memory.dmpFilesize
336KB
-
memory/3424-136-0x00000000098A0000-0x000000000993F000-memory.dmpFilesize
636KB
-
memory/3856-137-0x0000000000000000-mapping.dmp