Overview

overview

10

Static

static

10

ccca5622a8...31.exe

windows7_x64

10

ccca5622a8...31.exe

windows10_x64

10

Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    06-07-2021 19:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ccca5622a897b68c447ec67152486131.exe

  • Size

    112KB

  • MD5

    ccca5622a897b68c447ec67152486131

  • SHA1

    3d772b348a8c542fbbb3d777f92b436c19c02053

  • SHA256

    4c580d69b3340f544a71a42bf228f7f6bccfe976dee82c13a957925e88bf71dd

  • SHA512

    49e2ed40da2dac2e8818722727054fb262b41018dcbf4a5ee883e1a9310380d67a76d3dfb94bd59d7ed6bde8933f498ee675bfec0534821ea4ef3ddc9f760caa

Score
10/10
xmrigminerpersistence

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs
    persistence
  • Loads dropped DLL 3 IoCs
  • Creates a Windows Service
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccca5622a897b68c447ec67152486131.exe
    "C:\Users\Admin\AppData\Local\Temp\ccca5622a897b68c447ec67152486131.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\ccca5622a897b68c447ec67152486131.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 1
        3⤵
        • Runs ping.exe
        PID:2356
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "serivces"
    1⤵
      PID:540
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "serivces"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:648
      • C:\Windows\SysWOW64\serivces.exe
        C:\Windows\system32\serivces.exe "c:\windows\fonts\259266359.dll",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3484

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Remote System Discovery

    1
    T1018

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\serivces.exe
      MD5

      f57886ace1ab4972b0308f69b1a0029c

      SHA1

      519b2a981cb522ed2b0901f9871f9aa9781a6cd5

      SHA256

      2be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852

      SHA512

      c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8

      Download Submit
    • C:\Windows\SysWOW64\serivces.exe
      MD5

      f57886ace1ab4972b0308f69b1a0029c

      SHA1

      519b2a981cb522ed2b0901f9871f9aa9781a6cd5

      SHA256

      2be981b3686ee5e725583f5936f5f0a0992723cad784457f91d9d1d5a15a0852

      SHA512

      c2b3f016a8c3993771cd5709e469c9dedfa1dd35047691de5e853e2ad0ac025ec210fc6cb662c82d08f62e2c889e5060e796414a4eaf6a6c1719cdd7e5debdf8

      Download Submit
    • \??\c:\windows\fonts\259266359.dll
      MD5

      acd7d6a4a861947f64699491abc59c06

      SHA1

      d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

      SHA256

      ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

      SHA512

      ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

      Download Submit
    • \Windows\Fonts\259266359.dll
      MD5

      acd7d6a4a861947f64699491abc59c06

      SHA1

      d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

      SHA256

      ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

      SHA512

      ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

      Download Submit
    • \Windows\Fonts\259266359.dll
      MD5

      acd7d6a4a861947f64699491abc59c06

      SHA1

      d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

      SHA256

      ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

      SHA512

      ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

      Download Submit
    • \Windows\Fonts\259266359.dll
      MD5

      acd7d6a4a861947f64699491abc59c06

      SHA1

      d5a9a6341ad92ec925dfb0939d7dab6eacc343a7

      SHA256

      ef03ea62bc848a96bb252ba781d9b51fc5ef6f81f3c1ceb738e7d6d647b11337

      SHA512

      ccb112e512e6f6417ae7207639af7111e35f7db81ce60c02c30cd727e976d9a26759320cf1d52dffd7ace2fcc666d7abc6db726dd05f0a6c2eba4f079d5c2525

      Download Submit
    • memory/1640-117-0x0000000000000000-mapping.dmp
      Download
    • memory/2356-118-0x0000000000000000-mapping.dmp
      Download
    • memory/3484-119-0x0000000000000000-mapping.dmp
      Download