Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
300s -
max time network
280s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 08:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240412-en
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2528 cmd.exe 1092 cmd.exe 348 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 62 api.ipify.org 63 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\lvp.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2748 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 2748 ipconfig.exe 2748 ipconfig.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe 1092 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2748 ipconfig.exe 2748 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1092 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88 PID 2856 wrote to memory of 2748 2856 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:348
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
28B
MD55e6a9a1cf5e6b64923010cb8dd8e673a
SHA1a00d83ff77fcb8953ba1c292c4debadd6ce62ccb
SHA25613e64521106700daff93d4d79c0acf8b8fd115ad4d3e2c1760d59b76c7d3feed
SHA5127a0c288c62425262f7392a68ec3b17a2f51e822093a648e788050cbc3158268070eb79dae6db81e7e8469663d099945bd0c3b7a2420c7c381e1da2207fbcd6ef