Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:34
Static task
static1
Behavioral task
behavioral1
Sample
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe
Resource
win7-20220414-en
General
-
Target
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe
-
Size
1MB
-
MD5
ce854dd32e1d931cd6a791b30dcd9458
-
SHA1
0b247814ee8be3926e0dd64e749d7a4f174f96b7
-
SHA256
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a
-
SHA512
12cc6264daa1deaf81d59153f8cb9f9ed5b67dd45d6c954706c4a9052807384395ceb008b082e9bf903493dc9e52769fcf91a8295be9beae95655691a72c7e42
Malware Config
Signatures
-
XMRig Miner Payload ⋅ 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3960-135-0x0000000000624080-mapping.dmp xmrig behavioral2/memory/3960-138-0x0000000000400000-0x0000000000626000-memory.dmp xmrig behavioral2/memory/3960-141-0x000000000058C000-0x0000000000625000-memory.dmp xmrig -
Processes:
resource yara_rule behavioral2/memory/3960-130-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-132-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-133-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-136-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-137-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-138-0x0000000000400000-0x0000000000626000-memory.dmp upx -
Drops startup file ⋅ 1 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zylUYKzaGy.url wscript.exe -
Suspicious use of SetThreadContext ⋅ 1 IoCs
Processes:
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exedescription pid process target process PID 3184 set thread context of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 22 IoCs
Processes:
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exepid process 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
Processes:
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exenotepad.exedescription pid process Token: SeDebugPrivilege 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe Token: SeLockMemoryPrivilege 3960 notepad.exe Token: SeLockMemoryPrivilege 3960 notepad.exe -
Suspicious use of WriteProcessMemory ⋅ 14 IoCs
Processes:
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.execmd.exedescription pid process target process PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 2852 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe cmd.exe PID 3184 wrote to memory of 2852 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe cmd.exe PID 3184 wrote to memory of 2852 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe cmd.exe PID 2852 wrote to memory of 364 2852 cmd.exe wscript.exe PID 2852 wrote to memory of 364 2852 cmd.exe wscript.exe PID 2852 wrote to memory of 364 2852 cmd.exe wscript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exePID:3184"C:\Users\Admin\AppData\Local\Temp\ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\notepad.exePID:3960"C:\Windows\notepad.exe" -c "C:\ProgramData\iEtHqNVRGt\cfgi"Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exePID:2852cmd.exe /C WScript "C:\ProgramData\iEtHqNVRGt\r.vbs"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exePID:364WScript "C:\ProgramData\iEtHqNVRGt\r.vbs"Drops startup file
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\ProgramData\iEtHqNVRGt\cfgiMD5
34bb94db8839a2aaeac48594a3f0ebe8
SHA1ba81d8aa9c4309a35c8e1f0a58791c3d39bf5edd
SHA256c09aec150148504183dac3ea39b5d3f04bb1779f27da8cca219e1990071cbede
SHA51286ebc7ead25933cac0c0668fb5a4d2dea38dabee20f0771a30ffa79d0a852bae19f659ae4b29fce72d4cfd4e26264874fb4566211b03e9dc554e53425b26a592
-
C:\ProgramData\iEtHqNVRGt\r.vbsMD5
b23a1fc8e307280ef31a642edfce3a21
SHA1383a780d371e77d5235420d88e951784397fe92d
SHA25673d8861c33c983a15faa95dddb4cdbc2b4937884e806a7d84bf8442bc7861067
SHA51204c753ef23e9d8f02f3e022e61efa68ee0c284f4395d4dbbf561a643ff998b377e767e19411b53b382bb4fb8b17fdeb7214bbe3cac14ab40f5aefb396413a0f8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zylUYKzaGy.urlMD5
0635cf33c47c96c413afe48d40842b84
SHA1f3c064987470725dea67c15807dbb7efb52fc72b
SHA2560c7b61e072a3b51c27d9b1beb7751a49fc830973f7f4069c2651af5f049b8dc3
SHA512bfb65c35d2431eeca8c8635646517e94692d770edc8884d1c297a2b1688946288589196fb3fa409e81a351c894e30693e7d4cfffdfe4fbc85267ac8164483bae
-
memory/364-145-0x0000000000000000-mapping.dmp
-
memory/2852-144-0x0000000000000000-mapping.dmp
-
memory/3960-135-0x0000000000624080-mapping.dmp
-
memory/3960-138-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-137-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-140-0x000001E0B58D0000-0x000001E0B58E0000-memory.dmp
-
memory/3960-142-0x0000000000401000-0x000000000058C000-memory.dmp
-
memory/3960-141-0x000000000058C000-0x0000000000625000-memory.dmp
-
memory/3960-143-0x000001E0B58E0000-0x000001E0B58E4000-memory.dmp
-
memory/3960-130-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-136-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-133-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-132-0x0000000000400000-0x0000000000626000-memory.dmp
Loading data