Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
03-12-2021 22:57
Static task
static1
Behavioral task
behavioral1
Sample
be582c09e0366fe632e8608a5d6f562e.exe
Resource
win7-en-20211104
General
-
Target
be582c09e0366fe632e8608a5d6f562e.exe
-
Size
8.9MB
-
MD5
be582c09e0366fe632e8608a5d6f562e
-
SHA1
9a71a33e87bae9a612acdbc3c149bd587370cea9
-
SHA256
25d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
-
SHA512
a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
Malware Config
Signatures
-
XMRig Miner Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1608-145-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral2/memory/1608-146-0x0000000140310068-mapping.dmp xmrig behavioral2/memory/1608-148-0x0000000140000000-0x0000000140787000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
NvcDispCore.exesihost64.exepid process 2508 NvcDispCore.exe 1344 sihost64.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.exeNvcDispCore.exepid process 3576 be582c09e0366fe632e8608a5d6f562e.exe 2508 NvcDispCore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NvcDispCore.exedescription pid process target process PID 2508 set thread context of 1608 2508 NvcDispCore.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.exeNvcDispCore.exesvchost.exepid process 3576 be582c09e0366fe632e8608a5d6f562e.exe 3576 be582c09e0366fe632e8608a5d6f562e.exe 3576 be582c09e0366fe632e8608a5d6f562e.exe 2508 NvcDispCore.exe 2508 NvcDispCore.exe 2508 NvcDispCore.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe 1608 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.exeNvcDispCore.exesvchost.exedescription pid process Token: SeDebugPrivilege 3576 be582c09e0366fe632e8608a5d6f562e.exe Token: SeDebugPrivilege 2508 NvcDispCore.exe Token: SeLockMemoryPrivilege 1608 svchost.exe Token: SeLockMemoryPrivilege 1608 svchost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
be582c09e0366fe632e8608a5d6f562e.execmd.execmd.exeNvcDispCore.exedescription pid process target process PID 3576 wrote to memory of 3128 3576 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 3576 wrote to memory of 3128 3576 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 3128 wrote to memory of 3664 3128 cmd.exe schtasks.exe PID 3128 wrote to memory of 3664 3128 cmd.exe schtasks.exe PID 3576 wrote to memory of 4604 3576 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 3576 wrote to memory of 4604 3576 be582c09e0366fe632e8608a5d6f562e.exe cmd.exe PID 4604 wrote to memory of 2508 4604 cmd.exe NvcDispCore.exe PID 4604 wrote to memory of 2508 4604 cmd.exe NvcDispCore.exe PID 2508 wrote to memory of 1344 2508 NvcDispCore.exe sihost64.exe PID 2508 wrote to memory of 1344 2508 NvcDispCore.exe sihost64.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe PID 2508 wrote to memory of 1608 2508 NvcDispCore.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be582c09e0366fe632e8608a5d6f562e.exe"C:\Users\Admin\AppData\Local\Temp\be582c09e0366fe632e8608a5d6f562e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "NvcDispCore" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "NvcDispCore" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeC:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe boikkedyfhfngu0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJQKdDfd51MUAGcZ+8CiY/eWLlgevDJQNJNphk49DJ6FdVIyvPtVTvQRFVcAxXw/Gq0V+XWFNEvMwDJNClhXLRUhg4HOd5Vw5wGJV9O2w/YW9hKei0wFR3PJm5h6TRmZtvcZXAMNqYVfAn+gor+a6j3BUNCzQU+Nl5ZZOCpekJ75uKpyfuXINvdi/lHPgOl+x9FeCj4JbAhf/cMV3hidKaKceVP0M9KcmMWgapPHuqY3XOC0QJFfCsXgfmNJeoVSgEFcsORGCVXZlokEm+vbKv6NTCLNN22Q3s20NBp+zb5Q6OpTuYTUj0t9JmVN9eM+m/7r/tmE6CrDQbztcR1Xq/333vpYGcUDwERGyRYtYyNNpz2UvHLnFL9SnTr2PyNBgeUBw0IizbxQseQmOxnRmm4A4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeMD5
be582c09e0366fe632e8608a5d6f562e
SHA19a71a33e87bae9a612acdbc3c149bd587370cea9
SHA25625d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
SHA512a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
-
C:\Users\Admin\AppData\Roaming\Microsoft\NvcDispCore.exeMD5
be582c09e0366fe632e8608a5d6f562e
SHA19a71a33e87bae9a612acdbc3c149bd587370cea9
SHA25625d7abfa8b1175a98ad3f64ebdd5a01904ed73f739571eb39fde09a48d0ff8a7
SHA512a9fd645d812f09363aa2eb8e6515a352c6749a6155a7dc697c73271f0f39c7db820c9299dce70859b38532b07a7ea34a50c5c3dbaaf8cfc26f83470939f5074e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
d07170b788636b00c5160a24296cd8b3
SHA1d39d7238233e21cde888295a34069f07689b2ec6
SHA25609011b5dd881da303104480f6920a51b6c35d97e1ab7e436ebae2ffc399e23fd
SHA5129cc9b6f05539942d810c0b827cff9343e828997ef1359312c2782275e6f3c1543fd681e48224768f7a179826bf143d4b1b21b3002e03c8e56763d39961b8f9a4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
d07170b788636b00c5160a24296cd8b3
SHA1d39d7238233e21cde888295a34069f07689b2ec6
SHA25609011b5dd881da303104480f6920a51b6c35d97e1ab7e436ebae2ffc399e23fd
SHA5129cc9b6f05539942d810c0b827cff9343e828997ef1359312c2782275e6f3c1543fd681e48224768f7a179826bf143d4b1b21b3002e03c8e56763d39961b8f9a4
-
memory/1344-139-0x0000000000000000-mapping.dmp
-
memory/1608-151-0x0000023CB2A70000-0x0000023CB2A90000-memory.dmpFilesize
128KB
-
memory/1608-150-0x0000023CB10D0000-0x0000023CB10F0000-memory.dmpFilesize
128KB
-
memory/1608-149-0x0000023CB1090000-0x0000023CB10B0000-memory.dmpFilesize
128KB
-
memory/1608-148-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1608-147-0x0000023CB1030000-0x0000023CB1050000-memory.dmpFilesize
128KB
-
memory/1608-146-0x0000000140310068-mapping.dmp
-
memory/1608-145-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/2508-134-0x0000000000400000-0x0000000001562000-memory.dmpFilesize
17.4MB
-
memory/2508-142-0x000000001CE30000-0x000000001CE32000-memory.dmpFilesize
8KB
-
memory/2508-131-0x0000000000000000-mapping.dmp
-
memory/2508-144-0x000000001CE36000-0x000000001CE37000-memory.dmpFilesize
4KB
-
memory/2508-143-0x000000001CE33000-0x000000001CE35000-memory.dmpFilesize
8KB
-
memory/3128-128-0x0000000000000000-mapping.dmp
-
memory/3576-126-0x000000001CFC3000-0x000000001CFC5000-memory.dmpFilesize
8KB
-
memory/3576-127-0x000000001CFC6000-0x000000001CFC7000-memory.dmpFilesize
4KB
-
memory/3576-118-0x0000000000400000-0x0000000001562000-memory.dmpFilesize
17.4MB
-
memory/3576-124-0x0000000003360000-0x0000000003766000-memory.dmpFilesize
4.0MB
-
memory/3576-125-0x000000001CFC0000-0x000000001CFC2000-memory.dmpFilesize
8KB
-
memory/3576-123-0x0000000001BB0000-0x0000000001BB1000-memory.dmpFilesize
4KB
-
memory/3576-121-0x000000001D3E0000-0x000000001D7E3000-memory.dmpFilesize
4.0MB
-
memory/3576-119-0x00007FFD51DD0000-0x00007FFD51DD2000-memory.dmpFilesize
8KB
-
memory/3664-129-0x0000000000000000-mapping.dmp
-
memory/4604-130-0x0000000000000000-mapping.dmp