xmrig | 4a9006cf3b6e40360af21fbc2c9c419a58212f9fc06cb2a534240790a2e6dbac

Analysis

max time kernel
87s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
26-01-2021 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

Score

10^/10

xmrig discovery evasion miner persistence trojan

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 1 IoCs

Processes:

WINWORD.exe

pid process

796 WINWORD.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3776 icacls.exe

pid	process
796	WINWORD.exe

pid	process
3776	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\FlashPlayer Update = "C:\\Users\\Admin\\AppData\\Roaming\\divandshare.exe"	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

Drops file in System32 directory 1 IoCs

Processes:

de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\WINWORD.exe de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\WINWORD.exe	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.execmd.execmd.exe

description	pid	process	target process
PID 4696 wrote to memory of 684	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	cmd.exe
PID 4696 wrote to memory of 684	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	cmd.exe
PID 4696 wrote to memory of 684	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	cmd.exe
PID 4696 wrote to memory of 1020	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	cmd.exe
PID 4696 wrote to memory of 1020	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	cmd.exe
PID 4696 wrote to memory of 1020	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	cmd.exe
PID 684 wrote to memory of 3172	684	cmd.exe	cmd.exe
PID 684 wrote to memory of 3172	684	cmd.exe	cmd.exe
PID 684 wrote to memory of 3172	684	cmd.exe	cmd.exe
PID 684 wrote to memory of 3776	684	cmd.exe	icacls.exe
PID 684 wrote to memory of 3776	684	cmd.exe	icacls.exe
PID 684 wrote to memory of 3776	684	cmd.exe	icacls.exe
PID 1020 wrote to memory of 3188	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 3188	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 3188	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 4316	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 4316	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 4316	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 3096	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 3096	1020	cmd.exe	netsh.exe
PID 1020 wrote to memory of 3096	1020	cmd.exe	netsh.exe
PID 4696 wrote to memory of 796	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	WINWORD.exe
PID 4696 wrote to memory of 796	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	WINWORD.exe
PID 4696 wrote to memory of 796	4696	de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe	WINWORD.exe

C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe
"C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe"
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ECHO Y|icacls C:\Users\Admin\AppData\Roaming/divandshare.exe /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" ECHO Y"
3⤵
PID:3172

C:\Windows\SysWOW64\icacls.exe
icacls C:\Users\Admin\AppData\Roaming/divandshare.exe /grant administrators:F
3⤵
- Modifies file permissions
PID:3776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k (netsh advfirewall firewall delete rule name="TCP/UDP Control" | netsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow protocol=TCP localport=1930 | netsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe") & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="TCP/UDP Control"
3⤵
PID:3188

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow protocol=TCP localport=1930
3⤵
PID:4316

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="TCP/UDP Control" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149.exe"
3⤵
PID:3096

C:\Windows\SysWOW64\WINWORD.exe
"C:\Windows\System32\WINWORD.exe"
2⤵
- Executes dropped EXE
PID:796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\divandshare.exe
MD5
ab7a640c6b203e4675a45a08eb96a998

SHA1
89b5ba11a035ef784854c94df020d283b6802b82

SHA256
de36168cfc6c51cd53027916aea1b4227ab736e517319804b826c8d4a3006149

SHA512
0168c99f2a7a71f5bd8f629083288723f0e7997423e787af46828fabd3b887395ad31539e0623e6b0bbcd3dde926c7e4a68f78dcec088cc5e3ae227a34eadf55

Download Submit
C:\Windows\SysWOW64\WINWORD.exe
MD5
f695125cf286818943bc338deb796132

SHA1
e6de390e98c0c854a3b58950e00baa2abada9090

SHA256
a0d4439f9806edaf86751e0cffe63c762034080cddb7c9b6e7eaed74b0e79120

SHA512
bcfe9a3fdec4239133527fabf6a9cccf77c7fe0dee76a4dbf9c8c88b24154871c96aec5c7a954e2168f03594971d73a6c7a0ef074f0be65304aeb5eb455b60ac

Download Submit
C:\Windows\SysWOW64\WINWORD.exe
MD5
f695125cf286818943bc338deb796132

SHA1
e6de390e98c0c854a3b58950e00baa2abada9090

SHA256
a0d4439f9806edaf86751e0cffe63c762034080cddb7c9b6e7eaed74b0e79120

SHA512
bcfe9a3fdec4239133527fabf6a9cccf77c7fe0dee76a4dbf9c8c88b24154871c96aec5c7a954e2168f03594971d73a6c7a0ef074f0be65304aeb5eb455b60ac

Download Submit
memory/684-3-0x0000000000000000-mapping.dmp

Download
memory/796-14-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/796-11-0x0000000000000000-mapping.dmp

Download
memory/1020-4-0x0000000000000000-mapping.dmp

Download
memory/3096-10-0x0000000000000000-mapping.dmp

Download
memory/3172-5-0x0000000000000000-mapping.dmp

Download
memory/3188-8-0x0000000000000000-mapping.dmp

Download
memory/3776-6-0x0000000000000000-mapping.dmp

Download
memory/4316-9-0x0000000000000000-mapping.dmp

Download
memory/4696-2-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download