Analysis
-
max time kernel
107s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2024, 15:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
925ade29ba8a19d8ee9c975f7a2e7b49.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
General
-
Target
925ade29ba8a19d8ee9c975f7a2e7b49.exe
-
Size
3.1MB
-
MD5
925ade29ba8a19d8ee9c975f7a2e7b49
-
SHA1
e77bd3fbb537215e4c932f1c1305cef2e275996f
-
SHA256
b73df585c4404f7d9336de13f727cb3b2245ed2eec4016b9925641f444bc4eab
-
SHA512
b1129b8e3b6b770fd8dace8cf67cfc8a6e968068f46772dd768efaccb7b42145ce5809936c945d2428c63b3a9471d054a8c3eee1aa4ad4ea45c20bc77d39ec7b
-
SSDEEP
49152:NitOd4k7ydepSSPIZDscC+QZKDVdfu31e:NiK4IIZYfZKDVQFe
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 40 4748 cmd.exe 44 4748 cmd.exe 47 4748 cmd.exe 69 4748 cmd.exe 70 4748 cmd.exe 55 4748 cmd.exe 54 4748 cmd.exe 56 4748 cmd.exe 72 4748 cmd.exe 57 4748 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 4184 GetX64BTIT.exe -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\cms.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 3816 notepad.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe 4748 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3816 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4748 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84 PID 1232 wrote to memory of 3816 1232 925ade29ba8a19d8ee9c975f7a2e7b49.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\925ade29ba8a19d8ee9c975f7a2e7b49.exe"C:\Users\Admin\AppData\Local\Temp\925ade29ba8a19d8ee9c975f7a2e7b49.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:4184
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD50185a657fecb3aa7fe58de1e3faf2c8b
SHA1b8ced4913b64be206f1cdfca33cf798b49c38280
SHA256c428b0880c7f30e4c032ba863bdccae25c254238940e66b113f4635212c1c5dd
SHA512a298d9e13a52c088db1d27aa5c905deaddebb1ceed9a611344183f87c12f1ccee5db081e647363bd59b43774b41ce696cd4877db3b077cea7d57bf629ab1ce8d