Analysis

  • max time kernel
    76s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    10-09-2021 23:52

General

  • Target

    vv.exe

  • Size

    4.0MB

  • MD5

    9cadcadb612787dc6c2e9901ffe49dec

  • SHA1

    dfaeffadd7767ea23cabc31a59ae2cd461abf00f

  • SHA256

    6d6134155811eb82705509295bd4b87c6aaad43c1b54048c20d3cbf680494dfb

  • SHA512

    e7d908a73e85965359169b9d3e14ec3f1f81218354aa09a8d6c027be230e30c4f334122b933579ce6ad35e5eaffc01c6d8124e5f1a11671b7f6b36549d55beff

Malware Config

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vv.exe
    "C:\Users\Admin\AppData\Local\Temp\vv.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4876
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CF1.tmp" "c:\Users\Admin\AppData\Local\Temp\kgvouvyj\CSCD7C6624F86EE4BDA8EBC4BF80405E2C.TMP"
          4⤵
            PID:4904
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5036
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:972
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:688
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:4536
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:2732
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:4100
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2392
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:2396
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2712
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2176
                  • C:\Windows\SysWOW64\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:880
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:4732
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:424
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1040
                    • C:\Windows\SysWOW64\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1180
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:1268
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:3920
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:3948

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                    MD5

                    f3068198b62b4b70404ec46694d632be

                    SHA1

                    7b0b31ae227cf2a78cb751573a9d07f755104ea0

                    SHA256

                    bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

                    SHA512

                    ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

                  • C:\Users\Admin\AppData\Local\Temp\RES2CF1.tmp

                    MD5

                    0c1706617cf3eeb18e8c85e95bdb1bb3

                    SHA1

                    66733a046d944633d1d83fde85e6a8c91f1036e3

                    SHA256

                    0b34328a2d7312b47ae018d53905153993467f317bcad7882cb0f6e464b9adbf

                    SHA512

                    501d02068a979a700f050b3c836f6eab1a6d988278e98387c666379ed2a4198d3f03524601d94856371b94c183032874a470b60581639d167995f2954b5d267b

                  • C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

                    MD5

                    30303b0cc1d6833b7dc84fbb907822be

                    SHA1

                    caaa99bb9a56a6974ba16fce6e01f4f95016b9f5

                    SHA256

                    91b6b2284e42eb7bdf6371fcbaf1724027fc600cd9bb56ed81f2f7d8c784f617

                    SHA512

                    117cb2e2c687d2cca1c069151df4c085dcb4a88e51b1f17b8b0e2f9ce1adf181ed76b8cc1c262bee45e34d7a8b513d5bf19a50f394064cf5c132fec23a6fb7da

                  • C:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.dll

                    MD5

                    915f462c0b74d10e05ee71dd96356bde

                    SHA1

                    66c1aeb1f35fa9f12804fe683963974824f20de5

                    SHA256

                    d7004d973db948e5aba372def2ee81eb663e4dc4d8faf287fb1aef5827fac850

                    SHA512

                    a65e87e0df1b501a8a863c4f327d4077e720ace354fab155af5eb521a27f55039cbfd481ae02cc5ac93f7a9c77f2fc29ebd8f7463dda04556c97c328ef4ac11f

                  • C:\Users\Admin\AppData\Local\Temp\ready.ps1

                    MD5

                    28d9755addec05c0b24cca50dfe3a92b

                    SHA1

                    7d3156f11c7a7fb60d29809caf93101de2681aa3

                    SHA256

                    abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

                    SHA512

                    891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

                  • \??\c:\Users\Admin\AppData\Local\Temp\kgvouvyj\CSCD7C6624F86EE4BDA8EBC4BF80405E2C.TMP

                    MD5

                    c96cde0e70844a4d61e739eda88b91ae

                    SHA1

                    6f819dcfcb8c1c68603fd066c48e3305e7bd16f9

                    SHA256

                    a03b73546aac9b7f78edb6597341e6c291ffdbf4eb110a45f0a1afaa045481bd

                    SHA512

                    76b745c7b8e97dd47fe3f32060bce86fb35331ff5608be6d33fb1704182df78349abd3a9eb12246e95aba6d97157f6571b772c25e4b95c363c8eac207869416a

                  • \??\c:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.0.cs

                    MD5

                    9f8ab7eb0ab21443a2fe06dab341510e

                    SHA1

                    2b88b3116a79e48bab7114e18c9b9674e8a52165

                    SHA256

                    e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

                    SHA512

                    53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

                  • \??\c:\Users\Admin\AppData\Local\Temp\kgvouvyj\kgvouvyj.cmdline

                    MD5

                    1bdb829417a8b8520f128b50c3ee7366

                    SHA1

                    3ef871aa8b0e561a921bd5c2272a490d1eaad8db

                    SHA256

                    208abe1d06bff3d7723096e72196881c16b8b5157ac8d605c2076b5457af02ee

                    SHA512

                    65239ac1d2a0db19423b028e2e410e79af7b5a7c65ba963a713b540c53cbc15fa30e967a40c8b4c26b11944033a41b64e709109d406dd63a5debfbc3d220804b

                  • memory/424-1009-0x0000000000000000-mapping.dmp

                  • memory/688-696-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

                    Filesize

                    4KB

                  • memory/688-792-0x000000007FB40000-0x000000007FB41000-memory.dmp

                    Filesize

                    4KB

                  • memory/688-697-0x0000000004EC2000-0x0000000004EC3000-memory.dmp

                    Filesize

                    4KB

                  • memory/688-683-0x0000000000000000-mapping.dmp

                  • memory/880-1007-0x0000000000000000-mapping.dmp

                  • memory/972-432-0x0000000000000000-mapping.dmp

                  • memory/972-536-0x000000007FA80000-0x000000007FA81000-memory.dmp

                    Filesize

                    4KB

                  • memory/972-442-0x0000000007162000-0x0000000007163000-memory.dmp

                    Filesize

                    4KB

                  • memory/972-441-0x0000000007160000-0x0000000007161000-memory.dmp

                    Filesize

                    4KB

                  • memory/1040-1010-0x0000000000000000-mapping.dmp

                  • memory/1180-1011-0x0000000000000000-mapping.dmp

                  • memory/1268-1012-0x0000000000000000-mapping.dmp

                  • memory/2176-1006-0x0000000000000000-mapping.dmp

                  • memory/2392-1001-0x0000000000000000-mapping.dmp

                  • memory/2396-1002-0x0000000000000000-mapping.dmp

                  • memory/2712-1005-0x0000000000000000-mapping.dmp

                  • memory/2732-963-0x0000000000000000-mapping.dmp

                  • memory/3920-1025-0x0000000000000000-mapping.dmp

                  • memory/3948-1026-0x0000000000000000-mapping.dmp

                  • memory/4100-964-0x0000000000000000-mapping.dmp

                  • memory/4536-962-0x0000000000000000-mapping.dmp

                  • memory/4564-124-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-115-0x00000000051D0000-0x00000000055CF000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/4564-123-0x0000000004DB4000-0x0000000004DB5000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-122-0x0000000004DB3000-0x0000000004DB4000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-120-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-121-0x0000000004DB2000-0x0000000004DB3000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-119-0x00000000056F0000-0x00000000056F1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-118-0x0000000005770000-0x0000000005771000-memory.dmp

                    Filesize

                    4KB

                  • memory/4564-117-0x0000000005AD0000-0x0000000005AD1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-136-0x0000000007C80000-0x0000000007C81000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-153-0x00000000094E0000-0x00000000094E1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-1067-0x000000007F4D0000-0x000000007F4D1000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-125-0x0000000000000000-mapping.dmp

                  • memory/4680-128-0x0000000004D40000-0x0000000004D41000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-129-0x0000000007590000-0x0000000007591000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-130-0x0000000007480000-0x0000000007481000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-131-0x0000000007520000-0x0000000007521000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-133-0x0000000007E40000-0x0000000007E41000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-144-0x0000000009B50000-0x0000000009B51000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-134-0x0000000006F50000-0x0000000006F51000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-176-0x0000000008620000-0x0000000008621000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-155-0x0000000006F53000-0x0000000006F54000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-138-0x0000000008560000-0x0000000008561000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-135-0x0000000006F52000-0x0000000006F53000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-137-0x0000000008290000-0x0000000008291000-memory.dmp

                    Filesize

                    4KB

                  • memory/4680-145-0x0000000009260000-0x0000000009261000-memory.dmp

                    Filesize

                    4KB

                  • memory/4732-1008-0x0000000000000000-mapping.dmp

                  • memory/4876-146-0x0000000000000000-mapping.dmp

                  • memory/4904-149-0x0000000000000000-mapping.dmp

                  • memory/5036-212-0x0000000009240000-0x0000000009241000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-177-0x0000000000000000-mapping.dmp

                  • memory/5036-182-0x0000000007170000-0x0000000007171000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-183-0x0000000007172000-0x0000000007173000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-198-0x0000000008F60000-0x0000000008F93000-memory.dmp

                    Filesize

                    204KB

                  • memory/5036-206-0x0000000008F40000-0x0000000008F41000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-211-0x0000000009090000-0x0000000009091000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-412-0x00000000091D0000-0x00000000091D1000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-406-0x00000000091E0000-0x00000000091E1000-memory.dmp

                    Filesize

                    4KB

                  • memory/5036-281-0x000000007ED20000-0x000000007ED21000-memory.dmp

                    Filesize

                    4KB