Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
18/04/2024, 08:49
240418-krfthagd74 1018/04/2024, 08:48
240418-kqsrnsgd65 1018/04/2024, 08:48
240418-kqr55shg3z 1018/04/2024, 08:48
240418-kqmwesgd62 1018/04/2024, 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
300s -
max time network
192s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
14/04/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240412-en
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3884 cmd.exe 204 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 api.ipify.org 24 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\lvp.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 1624 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 1624 ipconfig.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe 3884 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1624 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3884 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72 PID 4200 wrote to memory of 1624 4200 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:204
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
226KB
MD550b930137463b14f73186c7c6767a2aa
SHA1574f512a44097275658f9c304ef0b74029e9ea46
SHA256eb51a0c96f7de6ce8bb0386429fff83bf95cb23fa61efe499b416f1cb0fc71c9
SHA5127f09ca777189d95d7ca0665a29c800a5228a93437b1067d7276e05d6da07bc6adc9644f545dc35ea0267dd8e7e312b414c9a613001e4f1d600bb481d4cbff872
-
Filesize
28B
MD5532ddf6bc1dcd3919b4206135d1dab1f
SHA1b24328ede38825a8a4e9870a37dde66e12654805
SHA25667a14366aa7e15acabb306288e68d44765df5e4ed1393a8ee75171ec825f7767
SHA5122d8d74c6057cf902f919c0c901908f664cd9e1693acd2e6dfe36dc85adf4dca1f2b2389d3a77efe9a52198eb14b1d0d2515bb04ccf3a8d4b219bc1a15816f327