Resubmissions

13-09-2021 08:21

210913-j9gyvagddm 10

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-04-2024 14:37

General

  • Target

    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe

  • Size

    566KB

  • MD5

    e08abfaa3f43ee68221fe4c21b9a0ea6

  • SHA1

    5092275c94bb50bfe326ffbe22a56aab5746b739

  • SHA256

    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d

  • SHA512

    dc7181f47541ad3e323baba9f763a5a0e315450b59b04d894835a25f5c074e2ab8fdd4170c83ae7c5c025861a206e553bcc77169bb76eb32fd098685954f57c9

  • SSDEEP

    12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvWG:pjOMtd1a/yl3KOjj

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    "C:\Users\Admin\AppData\Local\Temp\4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
      "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
      2⤵
      • Executes dropped EXE
      PID:2968

Network

  • flag-ca
    GET
    http://199.58.81.140/tor/status-vote/current/consensus
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    199.58.81.140:80
    Request
    GET /tor/status-vote/current/consensus HTTP/1.0
    Host: 199.58.81.140
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 14:38:41 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sun, 14 Apr 2024 15:00:00 GMT
    Vary: X-Or-Diff-From-Consensus
  • flag-us
    DNS
    api.ipify.org
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.12.205
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 14:38:44 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 14:38:44 GMT
  • flag-us
    DNS
    time-a.nist.gov
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    8.8.8.8:53
    Request
    time-a.nist.gov
    IN A
    Response
    time-a.nist.gov
    IN CNAME
    time-a-g.nist.gov
    time-a-g.nist.gov
    IN A
    129.6.15.28
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 14:39:15 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 14:39:15 GMT
  • flag-nl
    GET
    http://45.66.35.11/tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34b
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    45.66.35.11:80
    Request
    GET /tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34b HTTP/1.0
    Host: 45.66.35.11
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 14:39:45 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 14:39:45 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039d
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039d HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Sun, 14 Apr 2024 14:40:26 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Tue, 16 Apr 2024 14:40:26 GMT
  • 128.31.0.34:9131
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    152 B
    3
  • 193.23.244.244:80
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    152 B
    120 B
    3
    3
  • 199.58.81.140:80
    http://199.58.81.140/tor/status-vote/current/consensus
    http
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    96.7kB
    3.3MB
    1762
    2386

    HTTP Request

    GET http://199.58.81.140/tor/status-vote/current/consensus

    HTTP Response

    200
  • 104.26.13.205:443
    api.ipify.org
    tls
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    394 B
    259 B
    6
    6
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6
    http
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    371 B
    3.0kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6

    HTTP Response

    200
  • 158.69.48.49:443
    tls
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    372 B
    259 B
    6
    6
  • 129.6.15.28:13
    time-a.nist.gov
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    190 B
    223 B
    4
    4
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56
    http
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    371 B
    2.7kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56

    HTTP Response

    200
  • 70.63.170.86:443
    tls
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    418 B
    219 B
    7
    5
  • 45.66.35.11:80
    http://45.66.35.11/tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34b
    http
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    368 B
    3.2kB
    6
    6

    HTTP Request

    GET http://45.66.35.11/tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34b

    HTTP Response

    200
  • 5.255.102.43:80
    tls
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    372 B
    259 B
    6
    6
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039d
    http
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    417 B
    5.3kB
    7
    8

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039d

    HTTP Response

    200
  • 51.81.201.207:443
    tls
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    279 B
    179 B
    4
    4
  • 8.8.8.8:53
    api.ipify.org
    dns
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.13.205
    172.67.74.152
    104.26.12.205

  • 8.8.8.8:53
    time-a.nist.gov
    dns
    4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
    61 B
    100 B
    1
    1

    DNS Request

    time-a.nist.gov

    DNS Response

    129.6.15.28

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt

    Filesize

    28B

    MD5

    aeb5f76ea7684c039c9ab71817ecabab

    SHA1

    e9ee739ca3711a7ac62ddf3866b2409047a06775

    SHA256

    cf0879d7eb4cf166ba3deecfbb5a02f0f9d72a53fa97319c169dfea7b59cfcb1

    SHA512

    fa50dcd73ba9a0b8652fbb184d22c5100394e235da8ef11e924ed476012da867b6798b97a2bae7cf4c854ecf8bee53f60485f73004de4ad4c14dafd77ac5c4df

  • \Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

  • memory/2176-15-0x0000000010000000-0x0000000010016000-memory.dmp

    Filesize

    88KB

  • memory/2176-17-0x0000000001EF0000-0x0000000001F0F000-memory.dmp

    Filesize

    124KB

  • memory/2176-4-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-5-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-6-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-7-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-0-0x0000000000230000-0x0000000000288000-memory.dmp

    Filesize

    352KB

  • memory/2176-1-0x0000000000400000-0x0000000000490000-memory.dmp

    Filesize

    576KB

  • memory/2176-2-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-3-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-19-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-20-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-23-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-24-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-29-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-34-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-39-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

  • memory/2176-40-0x0000000000490000-0x0000000000539000-memory.dmp

    Filesize

    676KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.