Overview

overview

10

Static

static

26690dae11...ed.exe

windows7_x64

10

26690dae11...ed.exe

windows10_x64

10

Analysis

  • max time kernel
    107s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    02/09/2021, 08:42 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe

  • Size

    997KB

  • MD5

    ba454585b9f42c7254c931c192556e08

  • SHA1

    0b530303634283a43d53abd9190106869f57ba5a

  • SHA256

    26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa

  • SHA512

    2cb918eab6776c7cfea031cbb48cc4e33e068489a37f39ba1e246f32fef7a35c3511293b399c81b5b8056bca50d725554866584460f04efe0d65c1d1c625bc4b

Score
10/10
ouroborosxmrigevasionminerransomwarespywarestealer

Malware Config

Signatures

  • Ouroboros/Zeropadypt

    Ransomware family based on open-source CryptoWire.

    ransomwareouroboros
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • NTFS ADS 50 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
    "C:\Users\Admin\AppData\Local\Temp\26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe"
    1⤵
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop SQLWriter
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1836
      • C:\Windows\SysWOW64\net.exe
        net stop SQLWriter
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2008
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SQLWriter
          4⤵
            PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c net stop SQLBrowser
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:520
        • C:\Windows\SysWOW64\net.exe
          net stop SQLBrowser
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:528
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop SQLBrowser
            4⤵
              PID:864
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Windows\SysWOW64\net.exe
            net stop MSSQLSERVER
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1492
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MSSQLSERVER
              4⤵
                PID:2016
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Windows\SysWOW64\net.exe
              net stop MSSQL$CONTOSO1
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1780
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                4⤵
                  PID:1868
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop MSDTC
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1724
              • C:\Windows\SysWOW64\net.exe
                net stop MSDTC
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1268
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop MSDTC
                  4⤵
                    PID:1144
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                  PID:2036
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
                  2⤵
                    PID:1276
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                    2⤵
                      PID:1336
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                      2⤵
                        PID:608
                        • C:\Windows\SysWOW64\net.exe
                          net stop SQLSERVERAGENT
                          3⤵
                            PID:1720
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop SQLSERVERAGENT
                              4⤵
                                PID:1012
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                            2⤵
                              PID:428
                              • C:\Windows\SysWOW64\net.exe
                                net stop MSSQLSERVER
                                3⤵
                                  PID:2004
                                  • C:\Windows\SysWOW64\net1.exe
                                    C:\Windows\system32\net1 stop MSSQLSERVER
                                    4⤵
                                      PID:1044
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c net stop vds
                                  2⤵
                                    PID:1644
                                    • C:\Windows\SysWOW64\net.exe
                                      net stop vds
                                      3⤵
                                        PID:924
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 stop vds
                                          4⤵
                                            PID:1280
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                                        2⤵
                                          PID:672
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh advfirewall set currentprofile state off
                                            3⤵
                                              PID:856
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                                            2⤵
                                              PID:1888
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh firewall set opmode mode=disable
                                                3⤵
                                                  PID:1608

                                            Network

                                            • flag-unknown
                                              DNS
                                              www.sfml-dev.org
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              Remote address:
                                              8.8.8.8:53
                                              Request
                                              www.sfml-dev.org
                                              IN A
                                              Response
                                              www.sfml-dev.org
                                              IN CNAME
                                              sfml-dev.org
                                              sfml-dev.org
                                              IN A
                                              78.47.82.133
                                            • flag-unknown
                                              GET
                                              http://www.sfml-dev.org/ip-provider.php
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              Remote address:
                                              78.47.82.133:80
                                              Request
                                              GET /ip-provider.php HTTP/1.0
                                              content-length: 0
                                              from: user@sfml-dev.org
                                              host: www.sfml-dev.org
                                              user-agent: libsfml-network/2.x
                                              Response
                                              HTTP/1.1 200 OK
                                              Date: Thu, 02 Sep 2021 08:43:03 GMT
                                              Server: Apache
                                              Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-eval' 'unsafe-inline' *.sfml-dev.org www.gstatic.com www.google.com www.google-analytics.com ssl.google-analytics.com; connect-src 'self' www.google-analytics.com; img-src 'self' https: data:; style-src 'self' 'unsafe-inline' *.sfml-dev.org fonts.googleapis.com; media-src https: data:; font-src 'self' fonts.gstatic.com; base-uri 'self'; form-action 'self'; frame-src https: data:
                                              Content-Length: 12
                                              Connection: close
                                              Content-Type: text/html; charset=UTF-8
                                            • 78.47.82.133:80
                                              http://www.sfml-dev.org/ip-provider.php
                                              http
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              364 B
                                               829 B
                                               5
                                              5

                                              HTTP Request

                                              GET http://www.sfml-dev.org/ip-provider.php

                                              HTTP Response

                                              200
                                            • 80.82.69.52:8080
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              152 B
                                               3
                                            • 8.8.8.8:53
                                              www.sfml-dev.org
                                              dns
                                              26690dae115f47a1e0167750209a30cc68f51c5090e3b908105c93967e5156fa_unpacked.exe
                                              62 B
                                               92 B
                                               1
                                              1

                                              DNS Request

                                              www.sfml-dev.org

                                              DNS Response

                                              78.47.82.133

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/856-89-0x00000000750C1000-0x00000000750C3000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            We care about your privacy.

                                            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.