Resubmissions
22-09-2021 14:35
210922-ryctradad5 10Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14-04-2024 14:45
Static task
static1
Behavioral task
behavioral1
Sample
81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe
Resource
win10v2004-20240412-en
General
-
Target
81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe
-
Size
1.2MB
-
MD5
a1f481baa8334ad8a5c65919af2b6346
-
SHA1
aec7cd3a72d96948bf741bba48048c1b5cf3f036
-
SHA256
81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb
-
SHA512
e0c28dabe65224c2a40612e18807dc7ccdb58168be304f38f625936b1ebbdf1a6233f6e8f3d3a676e9c82ae3d9e6477cdeac8299c670ae3676b3ca4c3fc434a8
-
SSDEEP
12288:u+rq0yKJ7KZeBA4DVzlzEyn2QFqTjCAjkTnV/QH7OTzId2nfpN3fXz:FW0yreAkpzP/QCAjkTmbOwYRZj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe -
Executes dropped EXE 1 IoCs
pid Process 1156 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 api.ipify.org 29 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4436 wrote to memory of 692 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 94 PID 4436 wrote to memory of 692 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 94 PID 4436 wrote to memory of 1156 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 95 PID 4436 wrote to memory of 1156 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 95 PID 4436 wrote to memory of 4772 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 73 PID 4436 wrote to memory of 3272 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 74 PID 4436 wrote to memory of 1812 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 75 PID 4436 wrote to memory of 800 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 76 PID 4436 wrote to memory of 1280 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 77 PID 4436 wrote to memory of 5076 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 78 PID 4436 wrote to memory of 3772 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 79 PID 4436 wrote to memory of 4640 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 97 PID 4772 wrote to memory of 1764 4772 msedge.exe 104 PID 4772 wrote to memory of 1764 4772 msedge.exe 104 PID 4436 wrote to memory of 1764 4436 81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe 104
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe68314e48,0x7ffe68314e54,0x7ffe68314e602⤵PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2352,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:22⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:32⤵PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2580,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:82⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4788,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4724,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:3772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4128,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:82⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3524,i,7593277344190429033,13055212002259797845,262144 --variations-seed-version --mojo-platform-channel-handle=1396 /prefetch:32⤵PID:1764
-
-
C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"C:\Users\Admin\AppData\Local\Temp\81e2ddde718f731a46f765b613be06c7f77a5f43436c542fe5ac7218108228fb.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\windows\hh.exe"C:\windows\hh.exe"2⤵PID:692
-
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:1156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
25KB
MD5b1f568806aca0cb33bf60d9a921b688f
SHA182ba32935d7973616308cd58c5c96af340a0e618
SHA256d3a5174c886c39f25788f8da67a228061892d7554d0b43ac1ec0b60991fa409d
SHA5121c997e32631b6d55260e3cb54274f5f0dcd4db832bcb9bf44c4900f3de2b6847a9b416f82e4aa06d2dd97e8bbc1d9f1961f8752ba1a655a0fee88373da9deae2
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD530f11a93cdd19020967f1d26cde84150
SHA191b01e162001b2a6ba58d8e7ea1cb6e7d0577c63
SHA256c83d3e8062a8cbedbda99fc9adab6b5f4512f1f232960d79ceb715efdea9a65f
SHA512491a99f6a3a3c5ced19ae9e7de15dcff13788af6ff9a09da7764d331ee16d7be685348d42aceb8384bd0287b0a5fbd22b42ee5be7b398187d637d07d3e443977