Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 10:52
General
-
Target
f40b137db9bc978f5e32bdd45ac0cd6f52f61ea5c49ef3660a786352df1a3ecd.exe
-
Size
354KB
-
MD5
83442bfd37caf80bddd456fcdc21348c
-
SHA1
d9545548080bbd21772fb1498fc14f6ef05f2394
-
SHA256
f40b137db9bc978f5e32bdd45ac0cd6f52f61ea5c49ef3660a786352df1a3ecd
-
SHA512
16a136a80599751e3aa6c96aa58bec9b84fdddd21b3e98aeb9ac0f35678c496f990683d89ec350306d9ef9cd8d8e3164100dbdafaf699fe814698e6b864c5b81
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 3 IoCs
-
Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\f40b137db9bc978f5e32bdd45ac0cd6f52f61ea5c49ef3660a786352df1a3ecd.exe"C:\Users\Admin\AppData\Local\Temp\f40b137db9bc978f5e32bdd45ac0cd6f52f61ea5c49ef3660a786352df1a3ecd.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cttuutou\bthuName.exe"C:\Users\Admin\AppData\Roaming\cttuutou\bthuName.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~2C65.tmp"C:\Users\Admin\AppData\Local\Temp\~2C65.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\~2CA3.tmp.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\bitsider.exeC:\Windows\SysWOW64\bitsider.exe -k1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
579c3b4d90e171fa88017fba2c997388
SHA1190e15f6085d8bb0c81a8530af64ddf75fcb5df5
SHA256df98723b4e92d460eafdae111118197348e513974e7d9300ca36ee3f981afb04
SHA5126d8c1e0c9a51c71c4f6a1f451b83db584dc776e18f3010b481d7afdaac155c234043ebde6d8bbc3653eaf10d0a42aa444e764c3272cc46d987a7e84d3565e970
-
MD5
579c3b4d90e171fa88017fba2c997388
SHA1190e15f6085d8bb0c81a8530af64ddf75fcb5df5
SHA256df98723b4e92d460eafdae111118197348e513974e7d9300ca36ee3f981afb04
SHA5126d8c1e0c9a51c71c4f6a1f451b83db584dc776e18f3010b481d7afdaac155c234043ebde6d8bbc3653eaf10d0a42aa444e764c3272cc46d987a7e84d3565e970
-
MD5
d790423a93aa5c0ad659924d004d5dda
SHA18278cf6e8a997ff14a1a3958825c168941ea6422
SHA2564d3f3c44b21f1b42312bf7c1dcf5fc90c71b0b399aec011451123b5c99b5fab1
SHA5129a564c87f6c430e8f2180021920372593ce25eb7cf894fbce3e48ddcc2b49244eab2e30d871174b80d83fe0f8d949a49745c92db7d6362f0d2138dbe7ec503aa
-
MD5
69867cd3aa546ca73bfc4f6e54cfd689
SHA11d6c487b75f14ee0f25136c9bd6505174e648750
SHA2560f50fbe0540173e2aee070d5d54c8eb7b4737734204ba41065a937302eeea7fb
SHA51266c8b9244d6f4ebfaf4a6d8a09b4a82060dd6d0eb5b7b8235028420796670ca86716117fb261dc76d3c66d9c77bf7b2f0f9904e7fb2035d4a08a5f15b0a7fca0
-
MD5
c4ddce2875d5fa67b5fc2efbbd76865b
SHA15aa146ba0c41f5c19798a57eb8d2368fba1b647d
SHA25614d331812351cf30d6762eddb3c87766a90c854e655f7d1190f7cd8267bc6f82
SHA512d94fdf16a6a67a809360926ab81d472fb1fd9387acfe866fc0dc192988ece32321c2926f8ebc5b721905a517280f350b6a2e2958955343193c3a862e3ddffb8b
-
MD5
c4ddce2875d5fa67b5fc2efbbd76865b
SHA15aa146ba0c41f5c19798a57eb8d2368fba1b647d
SHA25614d331812351cf30d6762eddb3c87766a90c854e655f7d1190f7cd8267bc6f82
SHA512d94fdf16a6a67a809360926ab81d472fb1fd9387acfe866fc0dc192988ece32321c2926f8ebc5b721905a517280f350b6a2e2958955343193c3a862e3ddffb8b
-
MD5
83442bfd37caf80bddd456fcdc21348c
SHA1d9545548080bbd21772fb1498fc14f6ef05f2394
SHA256f40b137db9bc978f5e32bdd45ac0cd6f52f61ea5c49ef3660a786352df1a3ecd
SHA51216a136a80599751e3aa6c96aa58bec9b84fdddd21b3e98aeb9ac0f35678c496f990683d89ec350306d9ef9cd8d8e3164100dbdafaf699fe814698e6b864c5b81
-
MD5
83442bfd37caf80bddd456fcdc21348c
SHA1d9545548080bbd21772fb1498fc14f6ef05f2394
SHA256f40b137db9bc978f5e32bdd45ac0cd6f52f61ea5c49ef3660a786352df1a3ecd
SHA51216a136a80599751e3aa6c96aa58bec9b84fdddd21b3e98aeb9ac0f35678c496f990683d89ec350306d9ef9cd8d8e3164100dbdafaf699fe814698e6b864c5b81
-
Filesize
268KB
-
Filesize
1.3MB
-
-
Filesize
1.3MB
-
-
Filesize
432KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
43.1MB
-
Filesize
16.9MB
-
Filesize
31.0MB
-
Filesize
64KB
-