Analysis
- max time kernel
148s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
19/07/2020, 19:37
Static task
static1
Behavioral task
behavioral1
Sample
skynet_0.2.vir.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
skynet_0.2.vir.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target skynet_0.2.vir.exe
- Size 1.6MB
- Sample200719-mgt327pfpj
- SHA256 3ee04e378f6430e85f5756093e80b243c2ebbcb9f2ee77cc32acd1cd9e333301
- MD5 0adb101c9c09d85a19facdf4a68677e9
- SHA1 3ca97d68f8f7ecb5ef5b3df7a1cc45dc27d3ca6c
- SHA512 d761a847117bc3e9e740b63aba3bc17ceaf8892dc23cfd1e2c3ff091fb093db5357a44c23b33e9080dbdb67c6d8bba54151d6e153a97e310333edc5ba772338b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 76 IoCs
description pid Process procid_target PID 1536 wrote to memory of 3752 1536 skynet_0.2.vir.exe 67 PID 1536 wrote to memory of 3752 1536 skynet_0.2.vir.exe 67 PID 1536 wrote to memory of 3752 1536 skynet_0.2.vir.exe 67 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 1536 wrote to memory of 3832 1536 skynet_0.2.vir.exe 71 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 676 3840 svchost.exe 78 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1228 3840 svchost.exe 80 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 1596 3840 svchost.exe 82 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2160 3840 svchost.exe 84 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 2720 3840 svchost.exe 86 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 PID 3840 wrote to memory of 3308 3840 svchost.exe 88 - Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 1536 set thread context of 3912 1536 skynet_0.2.vir.exe 68 PID 1536 set thread context of 3840 1536 skynet_0.2.vir.exe 70 PID 1536 set thread context of 3832 1536 skynet_0.2.vir.exe 71 PID 3840 set thread context of 676 3840 svchost.exe 78 PID 3840 set thread context of 1228 3840 svchost.exe 80 PID 3840 set thread context of 1596 3840 svchost.exe 82 PID 3840 set thread context of 2160 3840 svchost.exe 84 PID 3840 set thread context of 2720 3840 svchost.exe 86 PID 3840 set thread context of 3308 3840 svchost.exe 88 - Executes dropped EXE 6 IoCs
pid Process 676 cgminer.exe 1228 cgminer.exe 1596 cgminer.exe 2160 cgminer.exe 2720 cgminer.exe 3308 cgminer.exe -
resource yara_rule behavioral2/memory/3912-0-0x0000000000400000-0x00000000006B3000-memory.dmp upx behavioral2/memory/3912-6-0x0000000000400000-0x00000000006B3000-memory.dmp upx behavioral2/memory/3912-9-0x0000000000400000-0x00000000006B3000-memory.dmp upx behavioral2/memory/676-370-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/676-380-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/676-381-0x0000000000400000-0x000000000044D000-memory.dmp upx - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\importtdoc.tmp svchost.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 checkip.dyndns.org - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3912 svchost.exe 3912 svchost.exe 3912 svchost.exe 3912 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe 3840 svchost.exe - Loads dropped DLL 18 IoCs
pid Process 676 cgminer.exe 676 cgminer.exe 676 cgminer.exe 1228 cgminer.exe 1228 cgminer.exe 1228 cgminer.exe 1596 cgminer.exe 1596 cgminer.exe 1596 cgminer.exe 2160 cgminer.exe 2160 cgminer.exe 2160 cgminer.exe 2720 cgminer.exe 2720 cgminer.exe 2720 cgminer.exe 3308 cgminer.exe 3308 cgminer.exe 3308 cgminer.exe - JavaScript code in executable 7 IoCs
resource yara_rule behavioral2/files/0x000100000001ad8e-374.dat js behavioral2/files/0x000100000001ad8e-375.dat js behavioral2/files/0x000100000001ad8e-385.dat js behavioral2/files/0x000100000001ad8e-393.dat js behavioral2/files/0x000100000001ad8e-401.dat js behavioral2/files/0x000100000001ad8e-409.dat js behavioral2/files/0x000100000001ad8e-417.dat js
Processes
-
C:\Users\Admin\AppData\Local\Temp\skynet_0.2.vir.exe"C:\Users\Admin\AppData\Local\Temp\skynet_0.2.vir.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1536 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"2⤵PID:3752
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe --HiddenServiceDir "C:\Users\Admin\AppData\Roaming\tor\hidden_service" --HiddenServicePort "55080 127.0.0.1:55080"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3912
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe (null)2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\cgminer.exe"C:\Users\Admin\AppData\Local\Temp\cgminer.exe" -o http://127.0.0.1:61677/btc/ -u user -p UB97ad2 -w 128 -I d -k poclbm --api-listen3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\cgminer.exe"C:\Users\Admin\AppData\Local\Temp\cgminer.exe" -o http://127.0.0.1:61677/btc/ -u user -p UB97ad2 -w 128 -I d -k poclbm --api-listen3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\cgminer.exe"C:\Users\Admin\AppData\Local\Temp\cgminer.exe" -o http://127.0.0.1:61677/btc/ -u user -p UB97ad2 -w 128 -I d -k poclbm --api-listen3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596
-
-
C:\Users\Admin\AppData\Local\Temp\cgminer.exe"C:\Users\Admin\AppData\Local\Temp\cgminer.exe" -o http://127.0.0.1:61677/btc/ -u user -p UB97ad2 -w 128 -I d -k poclbm --api-listen3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160
-
-
C:\Users\Admin\AppData\Local\Temp\cgminer.exe"C:\Users\Admin\AppData\Local\Temp\cgminer.exe" -o http://127.0.0.1:61677/btc/ -u user -p UB97ad2 -w 128 -I d -k poclbm --api-listen3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720
-
-
C:\Users\Admin\AppData\Local\Temp\cgminer.exe"C:\Users\Admin\AppData\Local\Temp\cgminer.exe" -o http://127.0.0.1:61677/btc/ -u user -p UB97ad2 -w 128 -I d -k poclbm --api-listen3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3308
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe ext "C:\Users\Admin\AppData\Local\Temp\skynet_0.2.vir.exe"2⤵PID:3832
-