Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 08:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
windows10-1703-x64
Behavioral task
behavioral4
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2256 cmd.exe 2828 GetX64BTIT.exe -
Loads dropped DLL 2 IoCs
pid Process 2220 ipconfig.exe 2256 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 api.ipify.org 20 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\lvp.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2220 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 2220 ipconfig.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe 2256 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2220 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2256 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 1304 wrote to memory of 2220 1304 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 28 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31 PID 2220 wrote to memory of 2256 2220 ipconfig.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Loads dropped DLL
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:2828
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5be7bda491b928cc38b649428d0759e72
SHA14599a7ffd82b89eb40d3d900053ad2a9a0f8f5c2
SHA25694390f531008da53eaf67e43eb49babc74c75686b87cc447de9f065c09606d32
SHA512fa6beeb93de995656c49166924377c4e44131c9436be0e8cf40c27906e352ad38f49b10692a003a67f96657f828f40139c2e40be7e02326d02c7fbecf9613eac
-
Filesize
295KB
MD5ad7b9c14083b52bc532fba5948342b98
SHA1ee8cbf12d87c4d388f09b4f69bed2e91682920b5
SHA25617f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae
SHA512e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1