Resubmissions
13-09-2021 08:08
210913-j1qvdsdch3 10Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 14:42
Static task
static1
Behavioral task
behavioral1
Sample
4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe
Resource
win10v2004-20240412-en
General
-
Target
4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe
-
Size
1.2MB
-
MD5
3719c2d7abe621d208c853cc425861d2
-
SHA1
3f317891a950a1a5e01b7e10715f8d62e5cf0f1f
-
SHA256
4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664
-
SHA512
d43c7487903a043cdd73fe3de3cdd87f9fe40277cdad55356061f6771b76f427049d5354b9c8f308badc946f451070d281d0421e9f8623d6922e7c59a10ae449
-
SSDEEP
12288:u+rq0yKJ7KZeBA4DVzlzEyn2QFqTjCAjkTnV/QH7OTzId2nfpN3fXQ:FW0yreAkpzP/QCAjkTmbOwYRZg
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe -
Executes dropped EXE 1 IoCs
pid Process 5100 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 api.ipify.org 32 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1592 wrote to memory of 2416 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 92 PID 1592 wrote to memory of 2416 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 92 PID 1592 wrote to memory of 5100 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 93 PID 1592 wrote to memory of 5100 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 93 PID 1592 wrote to memory of 1720 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 73 PID 1592 wrote to memory of 2920 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 74 PID 1592 wrote to memory of 1836 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 75 PID 1592 wrote to memory of 4860 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 76 PID 1592 wrote to memory of 3928 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 77 PID 1592 wrote to memory of 1548 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 78 PID 1592 wrote to memory of 1596 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 79 PID 1592 wrote to memory of 1992 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 95 PID 1720 wrote to memory of 4928 1720 msedge.exe 103 PID 1720 wrote to memory of 4928 1720 msedge.exe 103 PID 1592 wrote to memory of 4928 1592 4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe 103
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc23d44e48,0x7ffc23d44e54,0x7ffc23d44e602⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2096,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1972,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:32⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1996,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4456,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4412,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4060,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:82⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3032,i,2857654520668216285,12206737327839963915,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:32⤵PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe"C:\Users\Admin\AppData\Local\Temp\4177267c7688e0a4879695e76b87c4f00f91189a318288c9345a2fb3a9d50664.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\windows\hh.exe"C:\windows\hh.exe"2⤵PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:5100
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
25KB
MD539f923f73c28778f646cbb94cf790051
SHA14576b48a01a36823162b7dd5cbee0c08c294d8c4
SHA256a7204567cb75d0ea46c29bc5b44abfe66a865211c5990dad0c846fc4c16e5b14
SHA5120122310dd92824b9fd148b7cf2aa6697badc83b56738b79ca0adc6c24f257fb5c29a04686131a293fef890e6e252e54fbc006056d302300b00ad84cd8d507135
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5b466c71843dab56a7e69a49349561e13
SHA10f3a5e46b570bee669bb6c740c4fde3c298c64fc
SHA25615f492fd099d7e87d42331c2ae7f2a287954bd764f909a5b6e3ea51ae3b58fc2
SHA5122e6cd1c4ff7dd48b24a9939f50a109543f45c270c041ba3ed388c0beaf0ae46a0596d3c67456e568e572ce4c92bcb7f87ba39e1b090c9fb337d965dbdb379d08