Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 10:50
General
-
Target
e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924.exe
-
Size
294KB
-
MD5
35f5db065caece60369552162f60541a
-
SHA1
465a3153f210ab5bba612f96962275c68f356ee4
-
SHA256
e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924
-
SHA512
11b0dbe770af86619d6db04bf54f52031b901cb75fc4fcaa32c9ee5421f92debff2bef2eb00d02ab039aab88f33c2c20f5ab2620ffedf3d08071a6d2ce2a9f96
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Office document contains embedded OLE objects 1 IoCs
Detected embedded OLE objects in Office documents.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924.exe"C:\Users\Admin\AppData\Local\Temp\e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dllhsult\cttufsui.exe"C:\Users\Admin\AppData\Roaming\dllhsult\cttufsui.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~1572.tmp"C:\Users\Admin\AppData\Local\Temp\~1572.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~15A1.tmp.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\choigent.exeC:\Windows\SysWOW64\choigent.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
804ba1be6768539cb2b6d129005a78bc
SHA10298df53d7ed71850ec9c2840a5aedd233a0ac88
SHA256157a913751af580057e5eb9f24d2f5768d3a1872ec2421a37af75689f74ffa5e
SHA5121b4e003c9be40666b7b620777c3986953625608ef790125274c9b4416150e1fc29d89d5a8ba4e3df23ae4bb5d14b9753dd0dbc8619e8ccde4854db2a83633fdb
-
MD5
804ba1be6768539cb2b6d129005a78bc
SHA10298df53d7ed71850ec9c2840a5aedd233a0ac88
SHA256157a913751af580057e5eb9f24d2f5768d3a1872ec2421a37af75689f74ffa5e
SHA5121b4e003c9be40666b7b620777c3986953625608ef790125274c9b4416150e1fc29d89d5a8ba4e3df23ae4bb5d14b9753dd0dbc8619e8ccde4854db2a83633fdb
-
MD5
c4e99a484a7fdd2ba0aa42893ba2977c
SHA1609c444012fd6b11115dd0aa33729d863a5745c1
SHA256306a825a472c5f0967b7a72a426d0fd30313354abdf959d27db85aa33bb1c94c
SHA5126e0534c8e5fad4d9829624bd3229dce69e5b9140540768b643aef70e6768e006cbe7365d96bb10d29aadbb9bcf28554cb37c2c1ba28e593c10bebd11a367d75e
-
MD5
7f1d98d03afe344a89cd4f71ca5209ed
SHA12861a07173c85f26d35cf4fc199a7da05d7e3354
SHA25685a2e6155ca66a1feb4fc92238a1b34bf42b3380afc773b2b76501a96ba5c710
SHA512dcc596a1761c97660888e68475991ef6d05085533962d0f6554d842a279136ca6a8b9aa85b54b91cb853f9bdac3518d6b18671e129adec26555ace576395b224
-
MD5
4450c2bbffc831a8ce59af4e9e79d75e
SHA140fe250b7e82e722005965f6a7b12f076f758a9b
SHA256ec3ebc273a5a9d0f18570984edf5301b5ec5d196d72593087f3d7225fef08975
SHA5127121824739da40b7a55e3065f4ffee0f069de033b44d4961b39e3854cfda00a5b10d2711fee568a08ab38373f6a46669d9c36cb3ccf64873cc78d7e05b90083b
-
MD5
4450c2bbffc831a8ce59af4e9e79d75e
SHA140fe250b7e82e722005965f6a7b12f076f758a9b
SHA256ec3ebc273a5a9d0f18570984edf5301b5ec5d196d72593087f3d7225fef08975
SHA5127121824739da40b7a55e3065f4ffee0f069de033b44d4961b39e3854cfda00a5b10d2711fee568a08ab38373f6a46669d9c36cb3ccf64873cc78d7e05b90083b
-
MD5
35f5db065caece60369552162f60541a
SHA1465a3153f210ab5bba612f96962275c68f356ee4
SHA256e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924
SHA51211b0dbe770af86619d6db04bf54f52031b901cb75fc4fcaa32c9ee5421f92debff2bef2eb00d02ab039aab88f33c2c20f5ab2620ffedf3d08071a6d2ce2a9f96
-
MD5
35f5db065caece60369552162f60541a
SHA1465a3153f210ab5bba612f96962275c68f356ee4
SHA256e70d9c40dd3433fce51caab8da163820f67028daf9c06df865d8c564d22aa924
SHA51211b0dbe770af86619d6db04bf54f52031b901cb75fc4fcaa32c9ee5421f92debff2bef2eb00d02ab039aab88f33c2c20f5ab2620ffedf3d08071a6d2ce2a9f96
-
Filesize
1.3MB
-
-
Filesize
256KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
43.1MB
-
Filesize
16.9MB
-
Filesize
31.0MB
-
-
Filesize
268KB