Analysis
- max time kernel
50s - max time network
143s - platform
windows10_x64 - resource
win10v20201028 - submitted
25/02/2021, 13:50
General
- Target SecuriteInfo.com.Variant.Zusy.357020.22720.12615.exe
- Size 2.6MB
- Sample210225-w17tyebm12
- SHA256 ffd134c643a96d41f3e2e4cdbe7b7a5d2d3e0335921e49618d6b3f9ee896a948
Score
10/10
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner Payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.357020.22720.12615.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Zusy.357020.22720.12615.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\addins\ÃÅÂÞ±Ò\xmr.exe"C:\Windows\addins\ÃÅÂÞ±Ò\xmr.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~7322.tmp.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2248-7-0x00000000000B0000-0x00000000000C4000-memory.dmp
memory/2248-6-0x0000000000400000-0x0000000000E04000-memory.dmp
memory/2248-11-0x0000000000400000-0x0000000000E04000-memory.dmp
memory/2248-12-0x00000000001E0000-0x0000000000200000-memory.dmp
memory/2248-13-0x00000000015E0000-0x0000000001600000-memory.dmp