servhelper | edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121

Analysis

max time kernel
110s
max time network
122s
submitted
01/01/1970, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121.exe
Size

4.3MB
MD5

239348d287c11a59a46078a95c0274ba
SHA1

e27f3e5a2c8b629d799d3d04396fcec50c435e6f
SHA256

edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121
SHA512

69f0ef71d9d358ceb4a73345cefa48a8e388f6a9dd62aa82487fbe1983c8d372dd40407e756ac7245d45b85fdcc2c4b538b02d6a7b9cb3f874ea64cb0cbc0397

Score

10^/10

servhelper xmrig backdoor miner persistence trojan

Malware Config

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2712	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
1204	powershell.exe
1204	powershell.exe
1204	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
3884	powershell.exe
3884	powershell.exe
3884	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
636	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 3988	3364	edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121.exe	70
PID 3364 wrote to memory of 3988	3364	edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121.exe	70
PID 3364 wrote to memory of 3988	3364	edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121.exe	70
PID 3988 wrote to memory of 372	3988	powershell.exe	72
PID 3988 wrote to memory of 372	3988	powershell.exe	72
PID 3988 wrote to memory of 372	3988	powershell.exe	72
PID 372 wrote to memory of 1628	372	csc.exe	73
PID 372 wrote to memory of 1628	372	csc.exe	73
PID 372 wrote to memory of 1628	372	csc.exe	73
PID 3988 wrote to memory of 1204	3988	powershell.exe	74
PID 3988 wrote to memory of 1204	3988	powershell.exe	74
PID 3988 wrote to memory of 1204	3988	powershell.exe	74
PID 3988 wrote to memory of 3352	3988	powershell.exe	76
PID 3988 wrote to memory of 3352	3988	powershell.exe	76
PID 3988 wrote to memory of 3352	3988	powershell.exe	76
PID 3988 wrote to memory of 3884	3988	powershell.exe	78
PID 3988 wrote to memory of 3884	3988	powershell.exe	78
PID 3988 wrote to memory of 3884	3988	powershell.exe	78
PID 3988 wrote to memory of 2280	3988	powershell.exe	80
PID 3988 wrote to memory of 2280	3988	powershell.exe	80
PID 3988 wrote to memory of 2280	3988	powershell.exe	80
PID 3988 wrote to memory of 2712	3988	powershell.exe	81
PID 3988 wrote to memory of 2712	3988	powershell.exe	81
PID 3988 wrote to memory of 2712	3988	powershell.exe	81
PID 3988 wrote to memory of 1732	3988	powershell.exe	82
PID 3988 wrote to memory of 1732	3988	powershell.exe	82
PID 3988 wrote to memory of 1732	3988	powershell.exe	82
PID 3988 wrote to memory of 2952	3988	powershell.exe	83
PID 3988 wrote to memory of 2952	3988	powershell.exe	83
PID 3988 wrote to memory of 2952	3988	powershell.exe	83
PID 2952 wrote to memory of 504	2952	net.exe	84
PID 2952 wrote to memory of 504	2952	net.exe	84
PID 2952 wrote to memory of 504	2952	net.exe	84
PID 3988 wrote to memory of 3200	3988	powershell.exe	85
PID 3988 wrote to memory of 3200	3988	powershell.exe	85
PID 3988 wrote to memory of 3200	3988	powershell.exe	85
PID 3200 wrote to memory of 3628	3200	cmd.exe	86
PID 3200 wrote to memory of 3628	3200	cmd.exe	86
PID 3200 wrote to memory of 3628	3200	cmd.exe	86
PID 3628 wrote to memory of 3720	3628	cmd.exe	87
PID 3628 wrote to memory of 3720	3628	cmd.exe	87
PID 3628 wrote to memory of 3720	3628	cmd.exe	87
PID 3720 wrote to memory of 2708	3720	net.exe	88
PID 3720 wrote to memory of 2708	3720	net.exe	88
PID 3720 wrote to memory of 2708	3720	net.exe	88
PID 3988 wrote to memory of 660	3988	powershell.exe	89
PID 3988 wrote to memory of 660	3988	powershell.exe	89
PID 3988 wrote to memory of 660	3988	powershell.exe	89
PID 660 wrote to memory of 2880	660	cmd.exe	90
PID 660 wrote to memory of 2880	660	cmd.exe	90
PID 660 wrote to memory of 2880	660	cmd.exe	90
PID 2880 wrote to memory of 3736	2880	cmd.exe	91
PID 2880 wrote to memory of 3736	2880	cmd.exe	91
PID 2880 wrote to memory of 3736	2880	cmd.exe	91
PID 3736 wrote to memory of 3068	3736	net.exe	92
PID 3736 wrote to memory of 3068	3736	net.exe	92
PID 3736 wrote to memory of 3068	3736	net.exe	92
PID 3988 wrote to memory of 1080	3988	powershell.exe	97
PID 3988 wrote to memory of 1080	3988	powershell.exe	97
PID 3988 wrote to memory of 1080	3988	powershell.exe	97
PID 3988 wrote to memory of 1124	3988	powershell.exe	98
PID 3988 wrote to memory of 1124	3988	powershell.exe	98
PID 3988 wrote to memory of 1124	3988	powershell.exe	98

C:\Users\Admin\AppData\Local\Temp\edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121.exe
"C:\Users\Admin\AppData\Local\Temp\edc29fe698230e37846eaa00d4aeed60550c09674bf628237c9b942e0085d121.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d5pplxag\d5pplxag.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:372
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD66B.tmp" "c:\Users\Admin\AppData\Local\Temp\d5pplxag\CSC5CA27E7958FB43B9BA8F4AEDFF411038.TMP"
      4⤵
      PID:1628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:2712
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:504
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3628
    - - C:\Windows\SysWOW64\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3720
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:2708
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:660
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Windows\SysWOW64\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1204-190-0x00000000051E2000-0x00000000051E3000-memory.dmp

Filesize
4KB

Download
memory/1204-189-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/1204-182-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1204-181-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1204-194-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/1204-282-0x000000007E8B0000-0x000000007E8B1000-memory.dmp

Filesize
4KB

Download
memory/3352-539-0x000000007F230000-0x000000007F231000-memory.dmp

Filesize
4KB

Download
memory/3352-444-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

Filesize
4KB

Download
memory/3352-445-0x0000000006BE2000-0x0000000006BE3000-memory.dmp

Filesize
4KB

Download
memory/3364-123-0x0000000004C42000-0x0000000004C43000-memory.dmp

Filesize
4KB

Download
memory/3364-120-0x00000000083D0000-0x00000000083D1000-memory.dmp

Filesize
4KB

Download
memory/3364-125-0x0000000008BD0000-0x0000000008BD1000-memory.dmp

Filesize
4KB

Download
memory/3364-115-0x0000000004D47000-0x000000000514D000-memory.dmp

Filesize
4.0MB

Download
memory/3364-124-0x0000000004C43000-0x0000000004C44000-memory.dmp

Filesize
4KB

Download
memory/3364-127-0x0000000004C44000-0x0000000004C45000-memory.dmp

Filesize
4KB

Download
memory/3364-116-0x0000000005150000-0x0000000005552000-memory.dmp

Filesize
4.0MB

Download
memory/3364-117-0x0000000000400000-0x0000000002FA5000-memory.dmp

Filesize
43.6MB

Download
memory/3364-122-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/3364-121-0x0000000008A10000-0x0000000008A11000-memory.dmp

Filesize
4KB

Download
memory/3364-126-0x0000000008F50000-0x0000000008F51000-memory.dmp

Filesize
4KB

Download
memory/3364-118-0x0000000007FD0000-0x00000000083CF000-memory.dmp

Filesize
4.0MB

Download
memory/3884-702-0x00000000030A2000-0x00000000030A3000-memory.dmp

Filesize
4KB

Download
memory/3884-700-0x00000000030A0000-0x00000000030A1000-memory.dmp

Filesize
4KB

Download
memory/3884-726-0x000000007EC30000-0x000000007EC31000-memory.dmp

Filesize
4KB

Download
memory/3988-139-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/3988-138-0x0000000007EC0000-0x0000000007EC1000-memory.dmp

Filesize
4KB

Download
memory/3988-148-0x0000000008BA0000-0x0000000008BA1000-memory.dmp

Filesize
4KB

Download
memory/3988-158-0x00000000043F3000-0x00000000043F4000-memory.dmp

Filesize
4KB

Download
memory/3988-147-0x0000000009490000-0x0000000009491000-memory.dmp

Filesize
4KB

Download
memory/3988-143-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/3988-141-0x0000000007F10000-0x0000000007F11000-memory.dmp

Filesize
4KB

Download
memory/3988-179-0x0000000008F90000-0x0000000008F91000-memory.dmp

Filesize
4KB

Download
memory/3988-140-0x00000000043F2000-0x00000000043F3000-memory.dmp

Filesize
4KB

Download
memory/3988-156-0x00000000069D0000-0x00000000069D1000-memory.dmp

Filesize
4KB

Download
memory/3988-137-0x00000000075C0000-0x00000000075C1000-memory.dmp

Filesize
4KB

Download
memory/3988-136-0x0000000007770000-0x0000000007771000-memory.dmp

Filesize
4KB

Download
memory/3988-134-0x0000000007490000-0x0000000007491000-memory.dmp

Filesize
4KB

Download
memory/3988-133-0x00000000073F0000-0x00000000073F1000-memory.dmp

Filesize
4KB

Download
memory/3988-132-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

Filesize
4KB

Download
memory/3988-131-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/3988-130-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/3988-129-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/3988-1129-0x000000007EBD0000-0x000000007EBD1000-memory.dmp

Filesize
4KB

Download