Analysis
- max time kernel
138s - max time network
163s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/06/2021, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
b6d0f729c0717bae61ce9886e1dbd0d6.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target b6d0f729c0717bae61ce9886e1dbd0d6.exe
- Size 6.4MB
- Sample210624-eselaksm4e
- SHA256 7ac0238cad41d79e2fa25d52f32f6d670aeacdbc995de3125c657ebfd9edad2a
- MD5 b6d0f729c0717bae61ce9886e1dbd0d6
- SHA1 3103c8e427f0afde6761b085eb6165eceed2b712
- SHA512 11901a05f937fea9375e7a26496151ba9c1fb86f1e65b69674aafc144f68c1b864ca352526688dcd2cac826a0b540ca596ed9f74d09ab19b2f37b25ca706c225
- MD5 SHA1 SHA512
Malware Config
Signatures
- XMRig Miner Payload 6 IoCs
resource yara_rule behavioral1/files/0x00040000000130fb-77.dat xmrig behavioral1/files/0x00040000000130fb-79.dat xmrig behavioral1/files/0x00040000000130fb-80.dat xmrig behavioral1/files/0x00040000000130fb-95.dat xmrig behavioral1/files/0x00040000000130fb-93.dat xmrig behavioral1/files/0x00040000000130fb-96.dat xmrig - Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
pid Process 792 autoupdate.exe 596 procdump.exe 540 procdump64.exe 1928 updater.exe 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 540 updater.exe - Loads dropped DLL 8 IoCs
pid Process 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 596 procdump.exe 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 1780 Process not Found 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 1252 Process not Found - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1716 schtasks.exe 2024 schtasks.exe - GoLang User-Agent 8 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 10 Go-http-client/1.1 HTTP User-Agent header 11 Go-http-client/1.1 HTTP User-Agent header 13 Go-http-client/1.1 HTTP User-Agent header 2 Go-http-client/1.1 HTTP User-Agent header 5 Go-http-client/1.1 HTTP User-Agent header 6 Go-http-client/1.1 HTTP User-Agent header 7 Go-http-client/1.1 HTTP User-Agent header 8 Go-http-client/1.1 - Kills process with taskkill 4 IoCs
pid Process 1108 taskkill.exe 1044 taskkill.exe 1740 taskkill.exe 1832 taskkill.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 596 procdump.exe 596 procdump.exe 540 procdump64.exe 540 procdump64.exe 540 procdump64.exe 540 procdump64.exe 540 procdump64.exe 540 procdump64.exe 540 procdump64.exe 540 procdump64.exe 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1832 taskkill.exe Token: SeDebugPrivilege 1108 taskkill.exe Token: SeDebugPrivilege 1044 taskkill.exe Token: SeDebugPrivilege 596 procdump.exe Token: SeDebugPrivilege 540 procdump64.exe Token: SeLockMemoryPrivilege 1928 updater.exe Token: SeLockMemoryPrivilege 1928 updater.exe Token: SeDebugPrivilege 1740 taskkill.exe Token: SeLockMemoryPrivilege 540 updater.exe Token: SeLockMemoryPrivilege 540 updater.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1416 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 25 PID 1616 wrote to memory of 1416 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 25 PID 1616 wrote to memory of 1416 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 25 PID 1616 wrote to memory of 1796 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 28 PID 1616 wrote to memory of 1796 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 28 PID 1616 wrote to memory of 1796 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 28 PID 1796 wrote to memory of 1716 1796 cmd.exe 30 PID 1796 wrote to memory of 1716 1796 cmd.exe 30 PID 1796 wrote to memory of 1716 1796 cmd.exe 30 PID 1616 wrote to memory of 1832 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 31 PID 1616 wrote to memory of 1832 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 31 PID 1616 wrote to memory of 1832 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 31 PID 1616 wrote to memory of 1108 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 37 PID 1616 wrote to memory of 1108 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 37 PID 1616 wrote to memory of 1108 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 37 PID 1616 wrote to memory of 792 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 39 PID 1616 wrote to memory of 792 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 39 PID 1616 wrote to memory of 792 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 39 PID 1616 wrote to memory of 1044 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 40 PID 1616 wrote to memory of 1044 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 40 PID 1616 wrote to memory of 1044 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 40 PID 792 wrote to memory of 596 792 autoupdate.exe 42 PID 792 wrote to memory of 596 792 autoupdate.exe 42 PID 792 wrote to memory of 596 792 autoupdate.exe 42 PID 792 wrote to memory of 596 792 autoupdate.exe 42 PID 596 wrote to memory of 540 596 procdump.exe 44 PID 596 wrote to memory of 540 596 procdump.exe 44 PID 596 wrote to memory of 540 596 procdump.exe 44 PID 596 wrote to memory of 540 596 procdump.exe 44 PID 1616 wrote to memory of 1928 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 45 PID 1616 wrote to memory of 1928 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 45 PID 1616 wrote to memory of 1928 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 45 PID 1616 wrote to memory of 1528 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 48 PID 1616 wrote to memory of 1528 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 48 PID 1616 wrote to memory of 1528 1616 b6d0f729c0717bae61ce9886e1dbd0d6.exe 48 PID 1528 wrote to memory of 1604 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 47 PID 1528 wrote to memory of 1604 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 47 PID 1528 wrote to memory of 1604 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 47 PID 1528 wrote to memory of 1720 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 50 PID 1528 wrote to memory of 1720 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 50 PID 1528 wrote to memory of 1720 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 50 PID 1720 wrote to memory of 2024 1720 cmd.exe 52 PID 1720 wrote to memory of 2024 1720 cmd.exe 52 PID 1720 wrote to memory of 2024 1720 cmd.exe 52 PID 1528 wrote to memory of 1740 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 53 PID 1528 wrote to memory of 1740 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 53 PID 1528 wrote to memory of 1740 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 53 PID 1528 wrote to memory of 540 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 55 PID 1528 wrote to memory of 540 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 55 PID 1528 wrote to memory of 540 1528 b6d0f729c0717bae61ce9886e1dbd0d6.exe 55 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1416 attrib.exe 1604 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe"C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\attrib.exeattrib +S +H C:\Users\Admin\AppData\Local\Temp2⤵
- Views/modifies file attributes
PID:1416
-
-
C:\Windows\system32\cmd.exeC:\\Windows\system32\cmd.exe /c "schtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 02:27 /F"2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 02:27 /F3⤵
- Creates scheduled task(s)
PID:1716
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im download.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im autoupdate.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1108
-
-
C:\Users\Admin\AppData\Local\Temp\autoupdate.exeC:\Users\Admin\AppData\Local\Temp/autoupdate.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\procdump.exeC:\Users\Admin\AppData\Local\Temp/procdump.exe -accepteula -ma lsass.exe C:\Users\Admin\AppData\Local\Temp/1.dmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\procdump64.exeC:\Users\Admin\AppData\Local\Temp/procdump.exe -accepteula -ma lsass.exe C:\Users\Admin\AppData\Local\Temp/1.dmp4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im updater.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\updater.exeC:\Users\Admin\AppData\Local\Temp/updater.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1928
-
-
C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exeC:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\cmd.exeC:\\Windows\system32\cmd.exe /c "schtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 02:46 /F"3⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn winupdate /tr C:\Users\Admin\AppData\Local\Temp\b6d0f729c0717bae61ce9886e1dbd0d6.exe /sc DAILY /st 02:46 /F4⤵
- Creates scheduled task(s)
PID:2024
-
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im updater.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\updater.exeC:\Users\Admin\AppData\Local\Temp/updater.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
-
C:\Windows\system32\attrib.exeattrib +S +H C:\Users\Admin\AppData\Local\Temp1⤵
- Views/modifies file attributes
PID:1604