Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-03-2021 09:49

General

  • Target

    04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe

  • Size

    730KB

  • MD5

    07f1fa24a6fcb3708ab0689a2706ad8c

  • SHA1

    5da69784e467f242b4f0318fed2b3aed988c6466

  • SHA256

    04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be

  • SHA512

    59a67d2e495b948a45f32f67e3e2a85f0d8343942677e16d8f53162b42ba3a535dd72b713ca1ab59f871a7cbb614f13626741b782b2b2cc4c875bf3a82e83bfb

Score
9/10

Malware Config

Signatures

  • Detected Stratum cryptominer command

    Looks to be attempting to contact Stratum mining pool.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe
    "C:\Users\Admin\AppData\Local\Temp\04443c70d34ded7f17d3a00b0f3f7309291dbcb7957a1c5664aab6c7886b17be.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:292
    • C:\Windows\notepad.exe
      -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u boyeu1017@gmail.com -p x -t 1
      2⤵
        PID:1940
      • C:\Windows\notepad.exe
        -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u boyeu1017@gmail.com -p x -t 2
        2⤵
          PID:1364
        • C:\Windows\notepad.exe
          -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u boyeu1017@gmail.com -p x -t 1
          2⤵
            PID:536
          • C:\Windows\notepad.exe
            -a cryptonight -o stratum+tcp://xmr.pool.minergate.com:45560 -u boyeu1017@gmail.com -p x -t 2
            2⤵
              PID:1664

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          1
          T1112

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/292-2-0x0000000076861000-0x0000000076863000-memory.dmp
            Filesize

            8KB

          • memory/292-5-0x00000000000E0000-0x000000000019A000-memory.dmp
            Filesize

            744KB

          • memory/536-11-0x00000000004873E0-mapping.dmp
          • memory/1364-8-0x00000000004873E0-mapping.dmp
          • memory/1664-14-0x00000000004873E0-mapping.dmp
          • memory/1940-4-0x00000000004873E0-mapping.dmp
          • memory/1940-3-0x0000000000400000-0x0000000000489000-memory.dmp
            Filesize

            548KB

          • memory/1940-6-0x0000000000400000-0x0000000000489000-memory.dmp
            Filesize

            548KB