Overview

overview

8

Static

static

coin.ex_.exe

windows7_x64

8

coin.ex_.exe

windows10_x64

8

Resubmissions

10-09-2020 18:45

200910-l3cbla5d7e 8

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    10-09-2020 18:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    coin.ex_.exe

  • Size

    1.2MB

  • MD5

    1c74690ed0ad28f73f1aa9c4e71ccafa

  • SHA1

    e7f86a34f8f10a4476768dbbe29d9ff3f9e1e41a

  • SHA256

    0bef63123a8f21cb87cf4213e1c728a5137019c5a950580905a8f247c0b8c717

  • SHA512

    b2bbd1f2e948c5774793fdbe1181c1451c5b546866957c96c6b19858ae409b03630886bc41292f57aa33ed2ff64fb3f1185cfe4cb8a245cd130ae354d7e73462

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\coin.ex_.exe
    "C:\Users\Admin\AppData\Local\Temp\coin.ex_.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C WScript "C:\ProgramData\GCxcrhlcfj\r.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\SysWOW64\wscript.exe
        WScript "C:\ProgramData\GCxcrhlcfj\r.vbs"
        3⤵
        • Drops startup file
        PID:1752
    • C:\Windows\notepad.exe
      "C:\Windows\notepad.exe" -c "C:\ProgramData\GCxcrhlcfj\cfg"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:552
    • C:\Windows\notepad.exe
      "C:\Windows\notepad.exe" -c "C:\ProgramData\GCxcrhlcfj\cfgi"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1612
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\GCxcrhlcfj\cfg
    Download Submit
  • C:\ProgramData\GCxcrhlcfj\cfgi
    Download Submit
  • C:\ProgramData\GCxcrhlcfj\r.vbs
    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EJMbfDcdzM.url
    Download Submit
  • memory/552-5-0x0000000000400000-0x0000000000504000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/552-6-0x0000000000400000-0x0000000000504000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/552-7-0x0000000000400000-0x0000000000504000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/552-8-0x0000000000502B90-mapping.dmp
    Download
  • memory/552-9-0x0000000000400000-0x0000000000504000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/1612-14-0x0000000000502B90-mapping.dmp
    Download
  • memory/1752-2-0x0000000000000000-mapping.dmp
    Download
  • memory/3392-1-0x0000000000000000-mapping.dmp
    Download