Resubmissions
18-04-2024 08:49
240418-krfthagd74 1018-04-2024 08:48
240418-kqsrnsgd65 1018-04-2024 08:48
240418-kqr55shg3z 1018-04-2024 08:48
240418-kqmwesgd62 1018-04-2024 08:48
240418-kqmknahg3w 10Analysis
-
max time kernel
601s -
max time network
580s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 08:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win7-20231129-en
Behavioral task
behavioral3
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
Resource
win10v2004-20240412-en
General
-
Target
SecuriteInfo.com.BackDoor.Rat.281.18292.exe
-
Size
1.4MB
-
MD5
793707365df26450bc8642f518a540f0
-
SHA1
66649127ad784288c393992971a197c10f86a8eb
-
SHA256
7131d78da58eb6b54db8466e0c09d7173da6f05c5615841a73dc6a032648a217
-
SHA512
550374f2b3963e99bbfa445236e2921d288e67e00b4425a3bfedba0b72bd2fe6027af484c8f7e143471e16738dd9f129c91e467e157e29a911f1ad44d2775695
-
SSDEEP
24576:8Ec46GnhPe4h/N5m8loOoYJ/HRz1IgRizQJYiEH0YSXHZTNbf86:8EBQ2xrVEcXfbf86
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
cmd.exeGetX64BTIT.exepid process 4328 cmd.exe 3928 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 60 api.ipify.org 61 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Windows\Tasks\lvp.job cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3544 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SecuriteInfo.com.BackDoor.Rat.281.18292.exeipconfig.execmd.exepid process 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe 3544 ipconfig.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe 4328 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ipconfig.exepid process 3544 ipconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 4328 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.BackDoor.Rat.281.18292.exedescription pid process target process PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe PID 1476 wrote to memory of 3544 1476 SecuriteInfo.com.BackDoor.Rat.281.18292.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.281.18292.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"2⤵
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:3928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exeFilesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
C:\Users\Admin\AppData\Local\Temp\cmd.exeFilesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
C:\Users\Admin\AppData\Local\Temp\x64btit.txtFilesize
28B
MD549b5e9b501ad6fea1b8728024b7e7070
SHA15db91f1b02d08ba051c1a816ffa4a69a4f47ece7
SHA256d58c6ef5f9d23b177353ce083fcd7046ddd088cda417b9a3a97ef9d4f9bdcd7a
SHA512abff4e70d844520cc4662a7747248873c545f5f7f52b0606b7c3835257adf6d38b6aac7c8c9a1172f89b0fa740b4434d33c876af6460d3a4eea99b1728523ab3
-
memory/1476-3-0x0000000000400000-0x000000000056D000-memory.dmpFilesize
1.4MB
-
memory/1476-5-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/1476-6-0x0000000002470000-0x0000000002479000-memory.dmpFilesize
36KB
-
memory/1476-0-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/1476-1-0x0000000002470000-0x0000000002479000-memory.dmpFilesize
36KB
-
memory/3544-19-0x0000000002B70000-0x0000000002B78000-memory.dmpFilesize
32KB
-
memory/3544-20-0x0000000004700000-0x0000000004782000-memory.dmpFilesize
520KB
-
memory/3544-21-0x00007FFA06810000-0x00007FFA06A05000-memory.dmpFilesize
2.0MB
-
memory/3544-35-0x0000000004700000-0x0000000004782000-memory.dmpFilesize
520KB
-
memory/3544-2-0x0000000000850000-0x0000000000852000-memory.dmpFilesize
8KB
-
memory/4328-27-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-58-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-29-0x0000000001370000-0x0000000001377000-memory.dmpFilesize
28KB
-
memory/4328-38-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-39-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-41-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-40-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-43-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-28-0x0000000077328000-0x0000000077329000-memory.dmpFilesize
4KB
-
memory/4328-25-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-50-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-51-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-52-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-53-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-55-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-56-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-57-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-30-0x00007FFA06810000-0x00007FFA06A05000-memory.dmpFilesize
2.0MB
-
memory/4328-60-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-61-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-62-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-64-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-65-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-66-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-68-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-70-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-71-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-72-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-74-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-75-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-76-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-78-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/4328-80-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB