Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2956 cmd.exe 1976 GetX64BTIT.exe -
Loads dropped DLL 2 IoCs
pid Process 2624 ipconfig.exe 2956 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 api.ipify.org 19 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\lvp.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2624 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 2624 ipconfig.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe 2956 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2624 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2956 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2512 wrote to memory of 2624 2512 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31 PID 2624 wrote to memory of 2956 2624 ipconfig.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Loads dropped DLL
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:1976
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5e10d4a41e2cf5f61a93953c258fac4c2
SHA19f74d27b556e0ce02ebc782392d68daa5026d6e7
SHA25600854b9529c4455024d39081d659655f2da411ee8862f88d4dd13a2bac1da927
SHA51225bfca76766a62f80dc6e6c19f97c94afc121c52c4fa2001a310bb9b488ac6af35a3f774d8b3ca432265773891b6b7be4ad547f8128f9616248e5df7087775d5
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1