Overview

overview

10

Static

static

8

SvHost-3.exe

windows7_x64

10

SvHost-3.exe

windows10_x64

10

Resubmissions

25-06-2021 19:07

210625-wj3es9fxde 10

24-06-2021 06:02

210624-78vvv4fkks 10

Analysis

  • max time kernel
    52s
  • max time network
    108s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    24-06-2021 06:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SvHost-3.exe

  • Size

    1.3MB

  • MD5

    6d0cefa5b7f1744aa5dbc041c50b1709

  • SHA1

    023fe5cafe7f0b32bfaf1b3549785e4d36a13b63

  • SHA256

    c6da46d2abe90035674272a826d1203dde07338e27e3ebefc6335cbedb389019

  • SHA512

    fb3bef44b77d7d3b83c42f769236f2c7646f1642d07f3650199d6511a111b31cb917fdc9d776d0e4be5cffb374a162ce4cd09925463b94f9bf8be50501f66631

Score
10/10
ouroborosxmrigevasionminerransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Decrypt-info.txt

Ransom Note
All your files are encrypted due to security problem with your computer. You should pay money to recover your files. The price depends on how fast do you message us. You should contact us via this email address: [email protected] if you didn't receive any reply, message our second email address: [email protected] We guarantee that if you make payment, all your files will be recovered. You can send few example files. We recover them for you to prove that we can recover your files. Attention: Do not rename encrypted files. Do not try to decrypt your data using third-party software, it may cause permanent data loss. The decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Ouroboros/Zeropadypt

    Ransomware family based on open-source CryptoWire.

    ransomwareouroboros
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Drops file in Drivers directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 6 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SvHost-3.exe
    "C:\Users\Admin\AppData\Local\Temp\SvHost-3.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe
      "C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Drops startup file
      • Drops desktop.ini file(s)
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:552
        • C:\Windows\SysWOW64\net.exe
          net stop MSDTC
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1264
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop MSDTC
            5⤵
              PID:892
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
            PID:288
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
            3⤵
              PID:836
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
              3⤵
                PID:1640
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1724
                • C:\Windows\SysWOW64\net.exe
                  net stop SQLSERVERAGENT
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1812
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop SQLSERVERAGENT
                    5⤵
                      PID:1368
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1852
                  • C:\Windows\SysWOW64\net.exe
                    net stop MSSQLSERVER
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:804
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop MSSQLSERVER
                      5⤵
                        PID:1688
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:772
                    • C:\Windows\SysWOW64\net.exe
                      net stop vds
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1520
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop vds
                        5⤵
                          PID:1616
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                      3⤵
                        PID:1716
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh advfirewall set currentprofile state off
                          4⤵
                            PID:1760
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                          3⤵
                            PID:396
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh firewall set opmode mode=disable
                              4⤵
                                PID:388
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c net stop SQLWriter
                              3⤵
                                PID:1640
                                • C:\Windows\SysWOW64\net.exe
                                  net stop SQLWriter
                                  4⤵
                                    PID:1684
                                    • C:\Windows\SysWOW64\net1.exe
                                      C:\Windows\system32\net1 stop SQLWriter
                                      5⤵
                                        PID:1812
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                                    3⤵
                                      PID:1724
                                      • C:\Windows\SysWOW64\net.exe
                                        net stop SQLBrowser
                                        4⤵
                                          PID:528
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 stop SQLBrowser
                                            5⤵
                                              PID:804
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                          3⤵
                                            PID:1852
                                            • C:\Windows\SysWOW64\net.exe
                                              net stop MSSQLSERVER
                                              4⤵
                                                PID:1112
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\system32\net1 stop MSSQLSERVER
                                                  5⤵
                                                    PID:956
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                                3⤵
                                                  PID:1636
                                                  • C:\Windows\SysWOW64\net.exe
                                                    net stop MSSQL$CONTOSO1
                                                    4⤵
                                                      PID:1520
                                                      • C:\Windows\SysWOW64\net1.exe
                                                        C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                        5⤵
                                                          PID:772
                                                • C:\Windows\system32\NOTEPAD.EXE
                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Decrypt-info.txt
                                                  1⤵
                                                    PID:1608

                                                  Network

                                                  MITRE ATT&CK Enterprise v6

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/1036-59-0x0000000075721000-0x0000000075723000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download

                                                  • memory/1608-101-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmp

                                                    Filesize

                                                    8KB

                                                    Download