Overview

overview

10

Static

static

Windows Se...er.exe

windows7_x64

10

Windows Se...er.exe

windows10_x64

8

Resubmissions

25/06/2021, 20:08

210625-1ay8ymabc6 10

24/06/2021, 06:05

210624-z3rv4e1ed2 10

Analysis

  • max time kernel
    51s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    24/06/2021, 06:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windows Session Manager.exe

  • Size

    1.3MB

  • MD5

    000e2743bf3cb96cefc4be357765cec3

  • SHA1

    62b9b6afc91e349c56ce967985eec229f7db82aa

  • SHA256

    126f06426beeaaeea65331c5896590eb558405e5b924254e1aa17c3adc5c2fb3

  • SHA512

    b8298aed9d0ac929c9942ff8addce2a3b0e779093dad50fc99242542e8894fb0c45a5d4e60ed33691fc5fbcdeccfc9e50244dad6056500de8a28fddb6f6f275f

Score
10/10
xmrigevasionminerransomwarespywarestealer

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Drops file in Drivers directory 9 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • NTFS ADS 5 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows Session Manager.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          4⤵
            PID:1756
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:1784
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
          2⤵
            PID:1708
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
            2⤵
              PID:904
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1728
              • C:\Windows\SysWOW64\net.exe
                net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:556
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLSERVERAGENT
                  4⤵
                    PID:1092
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:484
                • C:\Windows\SysWOW64\net.exe
                  net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1920
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MSSQLSERVER
                    4⤵
                      PID:1900
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop vds
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:396
                  • C:\Windows\SysWOW64\net.exe
                    net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:572
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop vds
                      4⤵
                        PID:384
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                    2⤵
                      PID:1048
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh advfirewall set currentprofile state off
                        3⤵
                          PID:620
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                        2⤵
                          PID:568
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh firewall set opmode mode=disable
                            3⤵
                              PID:1652
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop SQLWriter
                            2⤵
                              PID:1828
                              • C:\Windows\SysWOW64\net.exe
                                net stop SQLWriter
                                3⤵
                                  PID:1752
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop SQLWriter
                                    4⤵
                                      PID:1168
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                                  2⤵
                                    PID:1784
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop SQLBrowser
                                      3⤵
                                        PID:1692
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop SQLBrowser
                                          4⤵
                                            PID:300
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                        2⤵
                                          PID:1188
                                          • C:\Windows\SysWOW64\net.exe
                                            net stop MSSQLSERVER
                                            3⤵
                                              PID:788
                                              • C:\Windows\SysWOW64\net1.exe
                                                C:\Windows\system32\net1 stop MSSQLSERVER
                                                4⤵
                                                  PID:1080
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                              2⤵
                                                PID:1932
                                                • C:\Windows\SysWOW64\net.exe
                                                  net stop MSSQL$CONTOSO1
                                                  3⤵
                                                    PID:960
                                                    • C:\Windows\SysWOW64\net1.exe
                                                      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                                      4⤵
                                                        PID:1920

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • memory/620-76-0x00000000765F1000-0x00000000765F3000-memory.dmp

                                                  Filesize

                                                  8KB

                                                  Download