Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
03-12-2021 22:57
Static task
static1
Behavioral task
behavioral1
Sample
be582c09e0366fe632e8608a5d6f562e.exe
Resource
win7-en-20211104
General
-
Target
be582c09e0366fe632e8608a5d6f562e.exe
-
Size
8.9MB
-
MD5
be582c09e0366fe632e8608a5d6f562e
-
SHA1
9a71a33e87bae9a612acdbc3c149bd587370cea9
-
SHA256
25d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
-
SHA512
a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
Malware Config
Signatures
-
XMRig Miner Payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/768-88-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-89-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-90-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-91-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-92-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-93-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-94-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-95-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-96-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-97-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-99-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/768-98-0x0000000140310068-mapping.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
NvcDispCore.exesihost64.exepid process 1400 NvcDispCore.exe 536 sihost64.exe -
Loads dropped DLL 4 IoCs
Processes:
cmd.exeNvcDispCore.exepid process 1172 cmd.exe 1172 cmd.exe 1400 NvcDispCore.exe 1400 NvcDispCore.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.exeNvcDispCore.exepid process 776 be582c09e0366fe632e8608a5d6f562e.exe 1400 NvcDispCore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NvcDispCore.exedescription pid process target process PID 1400 set thread context of 768 1400 NvcDispCore.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.exeNvcDispCore.exesvchost.exepid process 776 be582c09e0366fe632e8608a5d6f562e.exe 776 be582c09e0366fe632e8608a5d6f562e.exe 1400 NvcDispCore.exe 1400 NvcDispCore.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe 768 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.exeNvcDispCore.exesvchost.exedescription pid process Token: SeDebugPrivilege 776 be582c09e0366fe632e8608a5d6f562e.exe Token: SeDebugPrivilege 1400 NvcDispCore.exe Token: SeLockMemoryPrivilege 768 svchost.exe Token: SeLockMemoryPrivilege 768 svchost.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.execmd.execmd.exeNvcDispCore.exedescription pid process target process PID 776 wrote to memory of 1644 776 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 776 wrote to memory of 1644 776 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 776 wrote to memory of 1644 776 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 1644 wrote to memory of 1108 1644 cmd.exe schtasks.exe PID 1644 wrote to memory of 1108 1644 cmd.exe schtasks.exe PID 1644 wrote to memory of 1108 1644 cmd.exe schtasks.exe PID 776 wrote to memory of 1172 776 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 776 wrote to memory of 1172 776 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 776 wrote to memory of 1172 776 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 1172 wrote to memory of 1400 1172 cmd.exe NvcDispCore.exe PID 1172 wrote to memory of 1400 1172 cmd.exe NvcDispCore.exe PID 1172 wrote to memory of 1400 1172 cmd.exe NvcDispCore.exe PID 1400 wrote to memory of 536 1400 NvcDispCore.exe sihost64.exe PID 1400 wrote to memory of 536 1400 NvcDispCore.exe sihost64.exe PID 1400 wrote to memory of 536 1400 NvcDispCore.exe sihost64.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe PID 1400 wrote to memory of 768 1400 NvcDispCore.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be582c09e0366fe632e8608a5d6f562e.exe"C:\Users\Admin\AppData\Local\Temp\be582c09e0366fe632e8608a5d6f562e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "NvcDispCore" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "NvcDispCore" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeC:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe boikkedyfhfngu0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJQKdDfd51MUAGcZ+8CiY/eWLlgevDJQNJNphk49DJ6FdVIyvPtVTvQRFVcAxXw/Gq0V+XWFNEvMwDJNClhXLRUhg4HOd5Vw5wGJV9O2w/YW9hKei0wFR3PJm5h6TRmZtvcZXAMNqYVfAn+gor+a6j3BUNCzQU+Nl5ZZOCpekJ75uKpyfuXINvdi/lHPgOl+x9FeCj4JbAhf/cMV3hidKaKceVP0M9KcmMWgapPHuqY3XOC0QJFfCsXgfmNJeoVSgEFcsORGCVXZlokEm+vbKv6NTCLNN22Q3s20NBp+zb5Q6OpTuYTUj0t9JmVN9eM+m/7r/tmE6CrDQbztcR1Xq/333vpYGcUDwERGyRYtYyNNpz2UvHLnFL9SnTr2PyNBgeUBw0IizbxQseQmOxnRmm4A4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeMD5
be582c09e0366fe632e8608a5d6f562e
SHA19a71a33e87bae9a612acdbc3c149bd587370cea9
SHA25625d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
SHA512a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
-
C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeMD5
be582c09e0366fe632e8608a5d6f562e
SHA19a71a33e87bae9a612acdbc3c149bd587370cea9
SHA25625d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
SHA512a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
d07170b788636b00c5160a24296cd8b3
SHA1d39d7238233e21cde888295a34069f07689b2ec6
SHA25609011b5dd881da303104480f6920a51b6c35d97e1ab7e436ebae2ffc399e23fd
SHA5129cc9b6f05539942d810c0b827cff9343e828997ef1359312c2782275e6f3c1543fd681e48224768f7a179826bf143d4b1b21b3002e03c8e56763d39961b8f9a4
-
\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeMD5
be582c09e0366fe632e8608a5d6f562e
SHA19a71a33e87bae9a612acdbc3c149bd587370cea9
SHA25625d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
SHA512a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
-
\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeMD5
be582c09e0366fe632e8608a5d6f562e
SHA19a71a33e87bae9a612acdbc3c149bd587370cea9
SHA25625d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
SHA512a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
-
\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
d07170b788636b00c5160a24296cd8b3
SHA1d39d7238233e21cde888295a34069f07689b2ec6
SHA25609011b5dd881da303104480f6920a51b6c35d97e1ab7e436ebae2ffc399e23fd
SHA5129cc9b6f05539942d810c0b827cff9343e828997ef1359312c2782275e6f3c1543fd681e48224768f7a179826bf143d4b1b21b3002e03c8e56763d39961b8f9a4
-
\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
d07170b788636b00c5160a24296cd8b3
SHA1d39d7238233e21cde888295a34069f07689b2ec6
SHA25609011b5dd881da303104480f6920a51b6c35d97e1ab7e436ebae2ffc399e23fd
SHA5129cc9b6f05539942d810c0b827cff9343e828997ef1359312c2782275e6f3c1543fd681e48224768f7a179826bf143d4b1b21b3002e03c8e56763d39961b8f9a4
-
memory/536-79-0x0000000000000000-mapping.dmp
-
memory/768-90-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-93-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-102-0x0000000000190000-0x00000000001B0000-memory.dmpFilesize
128KB
-
memory/768-101-0x0000000000170000-0x0000000000190000-memory.dmpFilesize
128KB
-
memory/768-98-0x0000000140310068-mapping.dmp
-
memory/768-100-0x00000000000E0000-0x0000000000100000-memory.dmpFilesize
128KB
-
memory/768-99-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-97-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-96-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-95-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-94-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-92-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-91-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-89-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-88-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-87-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-86-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/768-85-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/776-59-0x000000001D590000-0x000000001D993000-memory.dmpFilesize
4.0MB
-
memory/776-55-0x0000000000400000-0x0000000001562000-memory.dmpFilesize
17.4MB
-
memory/776-61-0x000000001D002000-0x000000001D004000-memory.dmpFilesize
8KB
-
memory/776-63-0x000000001D006000-0x000000001D007000-memory.dmpFilesize
4KB
-
memory/776-62-0x000000001D004000-0x000000001D006000-memory.dmpFilesize
8KB
-
memory/776-57-0x0000000077080000-0x0000000077082000-memory.dmpFilesize
8KB
-
memory/776-58-0x0000000002DF0000-0x00000000031F6000-memory.dmpFilesize
4.0MB
-
memory/776-66-0x000000001D007000-0x000000001D008000-memory.dmpFilesize
4KB
-
memory/1108-65-0x0000000000000000-mapping.dmp
-
memory/1172-67-0x0000000000000000-mapping.dmp
-
memory/1400-81-0x000000001D1A2000-0x000000001D1A4000-memory.dmpFilesize
8KB
-
memory/1400-83-0x000000001D1A6000-0x000000001D1A7000-memory.dmpFilesize
4KB
-
memory/1400-73-0x0000000000400000-0x0000000001562000-memory.dmpFilesize
17.4MB
-
memory/1400-82-0x000000001D1A4000-0x000000001D1A6000-memory.dmpFilesize
8KB
-
memory/1400-71-0x0000000000000000-mapping.dmp
-
memory/1400-84-0x000000001D1A7000-0x000000001D1A8000-memory.dmpFilesize
4KB
-
memory/1644-64-0x0000000000000000-mapping.dmp