fakeav | d27ed6a4c7651591caf908dbcf36893ab1bee72b50d589efdf197b7df56bc0e3

General

Target

8d7bdc325fc2dd786959563f31281bac.exe
Size

2.8MB
MD5

8d7bdc325fc2dd786959563f31281bac
SHA1

7ebe2fb4816ae23b4b109f0b3480eaee7c897064
SHA256

d27ed6a4c7651591caf908dbcf36893ab1bee72b50d589efdf197b7df56bc0e3
SHA512

8866b412d6802ec85765b92171f0d04e98f860e0109d47b8460558a4242caa69563d24adc1b79e37e20522d9c2393e681ca967082e5762d0d12a65d046fe9985

Score

10^/10

fakeav xmrig fakeav miner persistence spyware

Malware Config

Signatures

FakeAV, RogueAntivirus
FakeAV or Rogue AntiVirus is a class of malware that displays false alert messages.
fakeav spyware fakeav
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

FakeAV payload 2 IoCs

fakeav spyware

resource	yara_rule
behavioral2/files/0x000200000001ab87-7.dat	fakeav
behavioral2/files/0x000200000001ab87-6.dat	fakeav

Executes dropped EXE 2 IoCs

pid	Process
2860	srtsrv32.exe
3400	lssmon.exe

Sets file execution options in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	8d7bdc325fc2dd786959563f31281bac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\lssmon.exe"	8d7bdc325fc2dd786959563f31281bac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Layersecurity Servicemonitor = "C:\\Windows\\system32\\LSSMON.EXE"	srtsrv32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\spool.exe	srtsrv32.exe
File created	C:\Windows\SysWOW64\LSASSMGR.EXE	srtsrv32.exe
File opened for modification	C:\Windows\SysWOW64\lssmon.exe	8d7bdc325fc2dd786959563f31281bac.exe
File created	C:\Windows\SysWOW64\srtsrv32.exe	8d7bdc325fc2dd786959563f31281bac.exe
File created	C:\Windows\SysWOW64\lssmon.exe	8d7bdc325fc2dd786959563f31281bac.exe
File created	C:\Windows\SysWOW64\spool.exe	srtsrv32.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\iexplor.exe	srtsrv32.exe
File created	C:\Program Files (x86)\Mozilla Firefox\firefoxe.exe	srtsrv32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\divx32.dll	8d7bdc325fc2dd786959563f31281bac.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4076	3400	WerFault.exe	74

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2860	1316	8d7bdc325fc2dd786959563f31281bac.exe	73
PID 1316 wrote to memory of 2860	1316	8d7bdc325fc2dd786959563f31281bac.exe	73
PID 1316 wrote to memory of 2860	1316	8d7bdc325fc2dd786959563f31281bac.exe	73
PID 1316 wrote to memory of 3400	1316	8d7bdc325fc2dd786959563f31281bac.exe	74
PID 1316 wrote to memory of 3400	1316	8d7bdc325fc2dd786959563f31281bac.exe	74
PID 1316 wrote to memory of 3400	1316	8d7bdc325fc2dd786959563f31281bac.exe	74

C:\Users\Admin\AppData\Local\Temp\8d7bdc325fc2dd786959563f31281bac.exe
"C:\Users\Admin\AppData\Local\Temp\8d7bdc325fc2dd786959563f31281bac.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\srtsrv32.exe
  "C:\Windows\system32\srtsrv32.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  PID:2860
- - C:\Windows\SysWOW64\LSASSMGR.EXE
    "C:\Windows\system32\LSASSMGR.EXE"
    3⤵
    PID:3140
  - - C:\Windows\SysWOW64\LSASSMGR.EXE
      "C:\Windows\system32\LSASSMGR.EXE"
      4⤵
      PID:2944
    - - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        5⤵
        
        PID:1732
      - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        6⤵
        
        PID:2576
- C:\Windows\SysWOW64\lssmon.exe
  "C:\Windows\system32\lssmon.exe"
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Windows\SysWOW64\srtsrv32.exe
    "C:\Windows\system32\srtsrv32.exe"
    3⤵
    PID:3996
  - - C:\Windows\SysWOW64\LSASSMGR.EXE
      "C:\Windows\system32\LSASSMGR.EXE"
      4⤵
      PID:3408
    - - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        5⤵
        
        PID:400
      - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        6⤵
        
        PID:2520
- - C:\Windows\SysWOW64\srtsrv32.exe
    "C:\Windows\system32\srtsrv32.exe"
    3⤵
    PID:1016
  - - C:\Windows\SysWOW64\LSASSMGR.EXE
      "C:\Windows\system32\LSASSMGR.EXE"
      4⤵
      PID:1836
    - - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        5⤵
        
        PID:968
      - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        6⤵
        
        PID:2544
- - C:\Windows\SysWOW64\srtsrv32.exe
    "C:\Windows\system32\srtsrv32.exe"
    3⤵
    PID:1272
  - - C:\Windows\SysWOW64\LSASSMGR.EXE
      "C:\Windows\system32\LSASSMGR.EXE"
      4⤵
      PID:792
    - - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        5⤵
        
        PID:2480
      - C:\Windows\SysWOW64\LSASSMGR.EXE
        
        "C:\Windows\system32\LSASSMGR.EXE"
        6⤵
        
        PID:2464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 1060
    3⤵
    - Program crash
    PID:4076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-60-0x0000000004B20000-0x0000000004B21000-memory.dmp

Filesize
4KB

Download
memory/4076-31-0x00000000042A0000-0x00000000042A1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing