788490416fe054993a1a4033b0f287399167eaad913a1cfc24efe324246645f4

General

Target

Defender.exe
Size

8.3MB
MD5

87fa7a1ee39276516b9753556897546d
SHA1

8c5db106bdda5304dc65a439d4bf806751117424
SHA256

788490416fe054993a1a4033b0f287399167eaad913a1cfc24efe324246645f4
SHA512

c7a9db600886f816b561aa9c73ba25784294b4d5ee537990c6b5efc4d0ed4adc3e728865bd7da692be3dc4f7e57efebadaa36d00b49075f046dacfce9136fe8f

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AddInProcess.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AddInProcess.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AddInProcess.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Defender.exe

description pid process target process

PID 3368 set thread context of 3984 3368 Defender.exe AddInProcess.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Defender.exe

pid process

3368 Defender.exe
3368 Defender.exe
3368 Defender.exe
3368 Defender.exe
3368 Defender.exe
3368 Defender.exe
3368 Defender.exe
3368 Defender.exe

description	pid	process	target process
PID 3368 set thread context of 3984	3368	Defender.exe	AddInProcess.exe

pid	process
3368	Defender.exe
3368	Defender.exe
3368	Defender.exe
3368	Defender.exe
3368	Defender.exe
3368	Defender.exe
3368	Defender.exe
3368	Defender.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Defender.exeAddInProcess.exe

description	pid	process
Token: SeDebugPrivilege	3368	Defender.exe
Token: SeLockMemoryPrivilege	3984	AddInProcess.exe
Token: SeLockMemoryPrivilege	3984	AddInProcess.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Defender.exe

description	pid	process	target process
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe
PID 3368 wrote to memory of 3984	3368	Defender.exe	AddInProcess.exe

C:\Users\Admin\AppData\Local\Temp\Defender.exe
"C:\Users\Admin\AppData\Local\Temp\Defender.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o xmr-eu1.nanopool.org:14444 -u 43M5FXdYoo56uynqTFUfC1XL4qSDQQoPA1YvSX64zN9SRqA22Bs2qUYHcHGpjS89HBQNeSFVq7ijDcbBuwWnEeurV8hWXNX.Admin -p x --algo rx/0
2⤵
- Checks BIOS information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3984

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3368-114-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/3368-116-0x000000001D010000-0x000000001D87C000-memory.dmp

Filesize
8.4MB

Download
memory/3368-117-0x0000000003B30000-0x0000000003B32000-memory.dmp

Filesize
8KB

Download
memory/3368-118-0x0000000020080000-0x00000000208C3000-memory.dmp

Filesize
8.3MB

Download
memory/3368-119-0x00000000208D0000-0x0000000021103000-memory.dmp

Filesize
8.2MB

Download
memory/3984-120-0x0000000140000000-0x0000000140D5F000-memory.dmp

Filesize
13.4MB

Download
memory/3984-121-0x0000000140D40000-mapping.dmp

Download
memory/3984-122-0x0000000140000000-0x0000000140D5F000-memory.dmp

Filesize
13.4MB

Download
memory/3984-123-0x00000261CFC40000-0x00000261CFC60000-memory.dmp

Filesize
128KB

Download
memory/3984-124-0x00000261CFC60000-0x00000261CFC80000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads