Analysis
-
max time kernel
153s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 14:08
Behavioral task
behavioral1
Sample
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe
Resource
win7-20220414-en
General
-
Target
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe
-
Size
773KB
-
MD5
28fb61a68956efd2dd8c76d2da0ac9e8
-
SHA1
1ac9eb475b3fbe7d818825fe9551e7e4e2d3cbff
-
SHA256
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373
-
SHA512
1792e750838cf1a66f63691d97aa8f09c70a9808ac1a26c67efde1ce86fae4e563c3be58fb206c53b1fbb7364221e8d278f8672b2f3e2868d6d39d4b6c38e78a
Malware Config
Signatures
-
XMRig Miner Payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-132-0x0000000000400000-0x000000000048D000-memory.dmp xmrig behavioral2/memory/1604-133-0x0000000000400000-0x000000000048D000-memory.dmp xmrig behavioral2/memory/1604-134-0x0000000000400000-0x000000000048D000-memory.dmp xmrig behavioral2/memory/1604-135-0x0000000000400000-0x000000000048D000-memory.dmp xmrig C:\ProgramData\Iostream.exe xmrig C:\ProgramData\Iostream.exe xmrig -
Executes dropped EXE 2 IoCs
Processes:
Iostream.exeIostream.exepid process 3124 Iostream.exe 2020 Iostream.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exedescription pid process target process PID 4152 set thread context of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2216 schtasks.exe 1824 schtasks.exe 3764 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exepid process 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe -
Suspicious behavior: RenamesItself 3 IoCs
Processes:
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exeIostream.exeIostream.exepid process 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe 3124 Iostream.exe 2020 Iostream.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
attrib.exedescription pid process Token: SeLockMemoryPrivilege 1604 attrib.exe Token: SeLockMemoryPrivilege 1604 attrib.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exeIostream.exeIostream.exedescription pid process target process PID 4152 wrote to memory of 3764 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe schtasks.exe PID 4152 wrote to memory of 3764 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe schtasks.exe PID 4152 wrote to memory of 3764 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe schtasks.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 4152 wrote to memory of 1604 4152 a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe attrib.exe PID 3124 wrote to memory of 2216 3124 Iostream.exe schtasks.exe PID 3124 wrote to memory of 2216 3124 Iostream.exe schtasks.exe PID 3124 wrote to memory of 2216 3124 Iostream.exe schtasks.exe PID 2020 wrote to memory of 1824 2020 Iostream.exe schtasks.exe PID 2020 wrote to memory of 1824 2020 Iostream.exe schtasks.exe PID 2020 wrote to memory of 1824 2020 Iostream.exe schtasks.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe"C:\Users\Admin\AppData\Local\Temp\a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Windows\Recovery\Cleaner /tr "C:\ProgramData\Iostream.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Views/modifies file attributes
-
C:\ProgramData\Iostream.exeC:\ProgramData\Iostream.exe1⤵
- Executes dropped EXE
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Windows\Recovery\Cleaner /tr "C:\ProgramData\Iostream.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f2⤵
- Creates scheduled task(s)
-
C:\ProgramData\Iostream.exeC:\ProgramData\Iostream.exe1⤵
- Executes dropped EXE
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \Windows\Recovery\Cleaner /tr "C:\ProgramData\Iostream.exe" /st 00:00 /sc once /du 9999:59 /ri 1 /f2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Iostream.exeFilesize
773KB
MD528fb61a68956efd2dd8c76d2da0ac9e8
SHA11ac9eb475b3fbe7d818825fe9551e7e4e2d3cbff
SHA256a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373
SHA5121792e750838cf1a66f63691d97aa8f09c70a9808ac1a26c67efde1ce86fae4e563c3be58fb206c53b1fbb7364221e8d278f8672b2f3e2868d6d39d4b6c38e78a
-
C:\ProgramData\Iostream.exeFilesize
773KB
MD528fb61a68956efd2dd8c76d2da0ac9e8
SHA11ac9eb475b3fbe7d818825fe9551e7e4e2d3cbff
SHA256a3e86b5863b0f331c745e72d7a4fca5628dc4f42ea6edbbfd9394c789de4f373
SHA5121792e750838cf1a66f63691d97aa8f09c70a9808ac1a26c67efde1ce86fae4e563c3be58fb206c53b1fbb7364221e8d278f8672b2f3e2868d6d39d4b6c38e78a
-
memory/1604-131-0x0000000000000000-mapping.dmp
-
memory/1604-132-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1604-133-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1604-134-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1604-135-0x0000000000400000-0x000000000048D000-memory.dmpFilesize
564KB
-
memory/1824-139-0x0000000000000000-mapping.dmp
-
memory/2216-137-0x0000000000000000-mapping.dmp
-
memory/3764-130-0x0000000000000000-mapping.dmp