Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 19:27
Static task
static1
Behavioral task
behavioral1
Sample
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe
Resource
win7-20220718-en
General
-
Target
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe
-
Size
729KB
-
MD5
ceafc5c7f3e853cd6649c80f98f14679
-
SHA1
ca8a755401d205f878a04b1d99ea52a8c15f5cc1
-
SHA256
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b
-
SHA512
d89c6486e71d6ca8a37021f78f7fac04e527e509899c9ca17165e923ace7294faab9d7b8861a2a5611270fbf691ea56e5e548ee99654d0d3a7a5d7161d5ed37e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
GetX64BTIT.exepid process 1208 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.ipify.org 8 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exedescription pid process target process PID 3500 set thread context of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exepid process 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exepid process 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exedescription pid process target process PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 3500 wrote to memory of 1596 3500 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe PID 1596 wrote to memory of 1208 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe GetX64BTIT.exe PID 1596 wrote to memory of 1208 1596 84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe GetX64BTIT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe"C:\Users\Admin\AppData\Local\Temp\84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe"C:\Users\Admin\AppData\Local\Temp\84232b982982de6271ce4f7a79e42b6aa9c141d826f9bdf902ea2697ee9ebe1b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD58d04c86bf9ed1fe933568c15f2dd891a
SHA1092c79a4c5d5ac9ce0afd80f12f69ac76583736f
SHA256576762ad46e4b085f2726c226f61d4383ac1d0cad4e6a4eafade1686e8e3b70d
SHA5129a2bb2210a2dba4d10a1814834b5b6729a91e4313a07dbc1867933e10869f01be7c5fc5c9328ad164fa53f018ca8501dcb6c4bbd180dd682733034bf11d1edec
-
memory/1208-138-0x0000000000000000-mapping.dmp
-
memory/1596-130-0x0000000000000000-mapping.dmp
-
memory/1596-131-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1596-133-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1596-136-0x0000000000460000-0x00000000004FF000-memory.dmpFilesize
636KB
-
memory/1596-137-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1596-142-0x0000000000460000-0x00000000004FF000-memory.dmpFilesize
636KB
-
memory/3500-134-0x0000000007ACE000-0x0000000007B23000-memory.dmpFilesize
340KB
-
memory/3500-135-0x0000000007A30000-0x0000000007A84000-memory.dmpFilesize
336KB