xmrig | 4c580d69b3340f544a71a42bf228f7f6bccfe976dee82c13a957925e88bf71dd

Analysis

max time kernel
142s
max time network
181s
platform
windows7_x64
resource
win7v20210410
submitted
06-07-2021 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccca5622a897b68c447ec67152486131.exe
Size

112KB
MD5

ccca5622a897b68c447ec67152486131
SHA1

3d772b348a8c542fbbb3d777f92b436c19c02053
SHA256

4c580d69b3340f544a71a42bf228f7f6bccfe976dee82c13a957925e88bf71dd
SHA512

49e2ed40da2dac2e8818722727054fb262b41018dcbf4a5ee883e1a9310380d67a76d3dfb94bd59d7ed6bde8933f498ee675bfec0534821ea4ef3ddc9f760caa

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Executes dropped EXE 1 IoCs

Processes:

serivces.exe

pid process

956 serivces.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1968 cmd.exe
Loads dropped DLL 7 IoCs

Processes:

ccca5622a897b68c447ec67152486131.exesvchost.exeserivces.exe

pid process

1668 ccca5622a897b68c447ec67152486131.exe
1240 svchost.exe
1240 svchost.exe
956 serivces.exe
956 serivces.exe
956 serivces.exe
956 serivces.exe
Creates a Windows Service
persistence
Drops file in System32 directory 2 IoCs

Processes:

svchost.exe

description ioc process

File created C:\Windows\SysWOW64\serivces.exe svchost.exe
File opened for modification C:\Windows\SysWOW64\serivces.exe svchost.exe
Drops file in Windows directory 1 IoCs

Processes:

ccca5622a897b68c447ec67152486131.exe

description ioc process

File created C:\Windows\fonts\259307888.dll ccca5622a897b68c447ec67152486131.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1872 PING.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ccca5622a897b68c447ec67152486131.exe

pid process

1668 ccca5622a897b68c447ec67152486131.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ccca5622a897b68c447ec67152486131.exe

description pid process

Token: SeIncBasePriorityPrivilege 1668 ccca5622a897b68c447ec67152486131.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ccca5622a897b68c447ec67152486131.exe

pid process

1668 ccca5622a897b68c447ec67152486131.exe

pid	process
956	serivces.exe

pid	process
1968	cmd.exe

pid	process
1668	ccca5622a897b68c447ec67152486131.exe
1240	svchost.exe
1240	svchost.exe
956	serivces.exe
956	serivces.exe
956	serivces.exe
956	serivces.exe

description	ioc	process
File created	C:\Windows\SysWOW64\serivces.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\serivces.exe	svchost.exe

description	ioc	process
File created	C:\Windows\fonts\259307888.dll	ccca5622a897b68c447ec67152486131.exe

pid	process
1872	PING.EXE

pid	process
1668	ccca5622a897b68c447ec67152486131.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1668	ccca5622a897b68c447ec67152486131.exe

pid	process
1668	ccca5622a897b68c447ec67152486131.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ccca5622a897b68c447ec67152486131.execmd.exesvchost.exe

description	pid	process	target process
PID 1668 wrote to memory of 1968	1668	ccca5622a897b68c447ec67152486131.exe	cmd.exe
PID 1668 wrote to memory of 1968	1668	ccca5622a897b68c447ec67152486131.exe	cmd.exe
PID 1668 wrote to memory of 1968	1668	ccca5622a897b68c447ec67152486131.exe	cmd.exe
PID 1668 wrote to memory of 1968	1668	ccca5622a897b68c447ec67152486131.exe	cmd.exe
PID 1968 wrote to memory of 1872	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 1872	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 1872	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 1872	1968	cmd.exe	PING.EXE
PID 1240 wrote to memory of 956	1240	svchost.exe	serivces.exe
PID 1240 wrote to memory of 956	1240	svchost.exe	serivces.exe
PID 1240 wrote to memory of 956	1240	svchost.exe	serivces.exe
PID 1240 wrote to memory of 956	1240	svchost.exe	serivces.exe

C:\Users\Admin\AppData\Local\Temp\ccca5622a897b68c447ec67152486131.exe
"C:\Users\Admin\AppData\Local\Temp\ccca5622a897b68c447ec67152486131.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\ccca5622a897b68c447ec67152486131.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 1
3⤵
- Runs ping.exe
PID:1872

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "serivces"
1⤵
PID:2044

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "serivces"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\serivces.exe
C:\Windows\system32\serivces.exe "c:\windows\fonts\259307888.dll",MainThread
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\serivces.exe
MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
C:\Windows\SysWOW64\serivces.exe
MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
\??\c:\windows\fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\Fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\Fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\Fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\Fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\Fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\Fonts\259307888.dll
MD5
acd7d6a4a861947f64699491abc59c06

SHA1
d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

SHA256
ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

SHA512
ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

Download Submit
\Windows\SysWOW64\serivces.exe
MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/956-66-0x0000000000000000-mapping.dmp

Download
memory/1668-59-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1872-64-0x0000000000000000-mapping.dmp

Download
memory/1968-63-0x0000000000000000-mapping.dmp

Download