Resubmissions
13-09-2021 08:21
210913-j9gyvagddm 10Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-04-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
Resource
win11-20240412-en
General
-
Target
4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe
-
Size
566KB
-
MD5
e08abfaa3f43ee68221fe4c21b9a0ea6
-
SHA1
5092275c94bb50bfe326ffbe22a56aab5746b739
-
SHA256
4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d
-
SHA512
dc7181f47541ad3e323baba9f763a5a0e315450b59b04d894835a25f5c074e2ab8fdd4170c83ae7c5c025861a206e553bcc77169bb76eb32fd098685954f57c9
-
SSDEEP
12288:Bz4ubZCXMtdUKat+YH7/yJ2je3rojGvB/WaEYvWG:pjOMtd1a/yl3KOjj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2968 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
pid Process 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe" 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2968 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 28 PID 2176 wrote to memory of 2968 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 28 PID 2176 wrote to memory of 2968 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 28 PID 2176 wrote to memory of 2968 2176 4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe"C:\Users\Admin\AppData\Local\Temp\4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:2968
-
Network
-
GEThttp://199.58.81.140/tor/status-vote/current/consensus4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exeRemote address:199.58.81.140:80RequestGET /tor/status-vote/current/consensus HTTP/1.0
Host: 199.58.81.140
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 191.101.209.39
Content-Encoding: identity
Expires: Sun, 14 Apr 2024 15:00:00 GMT
Vary: X-Or-Diff-From-Consensus
-
Remote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN A104.26.13.205api.ipify.orgIN A172.67.74.152api.ipify.orgIN A104.26.12.205
-
GEThttp://216.218.219.41/tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca64f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exeRemote address:216.218.219.41:80RequestGET /tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6 HTTP/1.0
Host: 216.218.219.41
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 191.101.209.39
Content-Encoding: identity
Expires: Tue, 16 Apr 2024 14:38:44 GMT
-
Remote address:8.8.8.8:53Requesttime-a.nist.govIN AResponsetime-a.nist.govIN CNAMEtime-a-g.nist.govtime-a-g.nist.govIN A129.6.15.28
-
GEThttp://216.218.219.41/tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d564f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exeRemote address:216.218.219.41:80RequestGET /tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56 HTTP/1.0
Host: 216.218.219.41
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 191.101.209.39
Content-Encoding: identity
Expires: Tue, 16 Apr 2024 14:39:15 GMT
-
GEThttp://45.66.35.11/tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34b4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exeRemote address:45.66.35.11:80RequestGET /tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34b HTTP/1.0
Host: 45.66.35.11
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 191.101.209.39
Content-Encoding: identity
Expires: Tue, 16 Apr 2024 14:39:45 GMT
-
GEThttp://216.218.219.41/tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039d4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exeRemote address:216.218.219.41:80RequestGET /tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039d HTTP/1.0
Host: 216.218.219.41
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 191.101.209.39
Content-Encoding: identity
Expires: Tue, 16 Apr 2024 14:40:26 GMT
-
152 B 3
-
152 B 120 B 3 3
-
199.58.81.140:80http://199.58.81.140/tor/status-vote/current/consensushttp4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe96.7kB 3.3MB 1762 2386
HTTP Request
GET http://199.58.81.140/tor/status-vote/current/consensusHTTP Response
200 -
104.26.13.205:443api.ipify.orgtls4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe394 B 259 B 6 6
-
216.218.219.41:80http://216.218.219.41/tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6http4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe371 B 3.0kB 6 6
HTTP Request
GET http://216.218.219.41/tor/server/fp/1425934fa39046386c3b2efc3d8f78e08a731ca6HTTP Response
200 -
372 B 259 B 6 6
-
190 B 223 B 4 4
-
216.218.219.41:80http://216.218.219.41/tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56http4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe371 B 2.7kB 6 6
HTTP Request
GET http://216.218.219.41/tor/server/fp/5365ba7c98f9b340b8100ec26317ac134b363d56HTTP Response
200 -
418 B 219 B 7 5
-
45.66.35.11:80http://45.66.35.11/tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34bhttp4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe368 B 3.2kB 6 6
HTTP Request
GET http://45.66.35.11/tor/server/fp/132a082ce32f3cdd1bdb80b240299a615346f34bHTTP Response
200 -
372 B 259 B 6 6
-
216.218.219.41:80http://216.218.219.41/tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039dhttp4f0784440bee1fc6002827cdc1b6663add2f111e3294cededd202443abb9f07d.exe417 B 5.3kB 7 8
HTTP Request
GET http://216.218.219.41/tor/server/fp/ba57222a0ec9ecdf003aed665dfb0b1287ea039dHTTP Response
200 -
279 B 179 B 4 4
-
59 B 107 B 1 1
DNS Request
api.ipify.org
DNS Response
104.26.13.205172.67.74.152104.26.12.205
-
61 B 100 B 1 1
DNS Request
time-a.nist.gov
DNS Response
129.6.15.28
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD5aeb5f76ea7684c039c9ab71817ecabab
SHA1e9ee739ca3711a7ac62ddf3866b2409047a06775
SHA256cf0879d7eb4cf166ba3deecfbb5a02f0f9d72a53fa97319c169dfea7b59cfcb1
SHA512fa50dcd73ba9a0b8652fbb184d22c5100394e235da8ef11e924ed476012da867b6798b97a2bae7cf4c854ecf8bee53f60485f73004de4ad4c14dafd77ac5c4df
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e