Analysis
- max time kernel
300s - max time network
192s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system - submitted
14/04/2024, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
300 seconds
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
10 signatures
300 seconds
General
- Target SecuriteInfo.com.BackDoor.Rat.281.18292.exe
- Size 1.4MB
- Sample240414-rxnvmacb5y
- SHA256 7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
- MD5 793707365df26450bc8642f518a540f0
- SHA1 66649127ad784288c393992971a197c10f86a8eb
- SHA512 550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
- SSDEEP 24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3884 cmd.exe 204 GetX64BTIT.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 api.ipify.org 24 api.ipify.org - Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
- Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\lvp.job cmd.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1624 ipconfig.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 1624 ipconfig.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1624 ipconfig.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3884 cmd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:204
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
- Size 3KB
- SHA256 91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
- MD5 b4cd27f2b37665f51eb9fe685ec1d373
- SHA1 7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
- SHA512 e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\cmd.exe
- Size 226KB
- SHA256 eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9
- MD5 50b930137463b14f73186c7c6767a2aa
- SHA1 574f512a44097275658f9c304ef0b74029e9ea46
- SHA512 7f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872
- SSDEEP 6144:qNBRH7QxrSdaHc2yeJ8mByAe0OLDIDHiRxrFyHXmb:qxArSdeJ8mBg0+IHWxrc3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\x64btit.txt
- Size 28B
- SHA256 67a14366aa7e15acabb306288e68d44765df5e4ed1393a8ee75171ec825f7767
- MD5 532ddf6bc1dcd3919b4206135d1dab1f
- SHA1 b24328ede38825a8a4e9870a37dde66e12654805
- SHA512 2d8d74c6057cf902f919c0c901908f664cd9e1693acd2e6dfe36dc85adf4dca1f2b2389d3a77efe9a52198eb14b1d0d2515bb04ccf3a8d4b219bc1a15816f327
- MD5 SHA1 SHA512