General
Target

b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe

Filesize

3MB

Completed

21-05-2022 11:25

Task

behavioral2

Score
10/10
MD5

855c397b671d85fb2422b31924f8af9f

SHA1

a2750adf76a245c6f822dc9723e9660b833ca8d4

SHA256

b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd

SHA512

921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09

Malware Config
Signatures 13

Filter: none

Discovery
Persistence
  • xmrig

    Description

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    Tags

  • XMRig Miner Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/5108-132-0x0000000000800000-0x000000000098B000-memory.dmpxmrig
    behavioral2/memory/5108-139-0x0000000000800000-0x000000000098B000-memory.dmpxmrig
    behavioral2/memory/4340-145-0x0000000000F00000-0x000000000108B000-memory.dmpxmrig
    behavioral2/memory/4340-153-0x0000000000F00000-0x000000000108B000-memory.dmpxmrig
  • Executes dropped EXE
    AdobeUpdateService.exeAdobeUpdateService.exe

    Reported IOCs

    pidprocess
    2116AdobeUpdateService.exe
    4340AdobeUpdateService.exe
  • Checks computer location settings
    b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nationb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
  • AutoIT Executable

    Description

    AutoIT scripts compiled to PE executables.

    Reported IOCs

    resourceyara_rule
    behavioral2/files/0x00040000000162ae-142.datautoit_exe
    behavioral2/files/0x00040000000162ae-143.datautoit_exe
    behavioral2/files/0x00040000000162ae-152.datautoit_exe
  • Suspicious use of SetThreadContext
    b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 916 set thread context of 5108916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    PID 2116 set thread context of 43402116AdobeUpdateService.exeAdobeUpdateService.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    4632schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    AdobeUpdateService.exe

    Reported IOCs

    pidprocess
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
    4340AdobeUpdateService.exe
  • Suspicious use of AdjustPrivilegeToken
    AdobeUpdateService.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeLockMemoryPrivilege4340AdobeUpdateService.exe
    Token: SeLockMemoryPrivilege4340AdobeUpdateService.exe
  • Suspicious use of FindShellTrayWindow
    b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe

    Reported IOCs

    pidprocess
    916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    2116AdobeUpdateService.exe
    2116AdobeUpdateService.exe
    2116AdobeUpdateService.exe
  • Suspicious use of SendNotifyMessage
    b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe

    Reported IOCs

    pidprocess
    916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    2116AdobeUpdateService.exe
    2116AdobeUpdateService.exe
    2116AdobeUpdateService.exe
  • Suspicious use of WriteProcessMemory
    b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 916 wrote to memory of 5108916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    PID 916 wrote to memory of 5108916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    PID 916 wrote to memory of 5108916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    PID 916 wrote to memory of 5108916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    PID 916 wrote to memory of 5108916b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeb741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    PID 5108 wrote to memory of 46325108b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeschtasks.exe
    PID 5108 wrote to memory of 46325108b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeschtasks.exe
    PID 5108 wrote to memory of 46325108b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeschtasks.exe
    PID 5108 wrote to memory of 21165108b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe
    PID 5108 wrote to memory of 21165108b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe
    PID 5108 wrote to memory of 21165108b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exeAdobeUpdateService.exe
    PID 2116 wrote to memory of 43402116AdobeUpdateService.exeAdobeUpdateService.exe
    PID 2116 wrote to memory of 43402116AdobeUpdateService.exeAdobeUpdateService.exe
    PID 2116 wrote to memory of 43402116AdobeUpdateService.exeAdobeUpdateService.exe
    PID 2116 wrote to memory of 43402116AdobeUpdateService.exeAdobeUpdateService.exe
    PID 2116 wrote to memory of 43402116AdobeUpdateService.exeAdobeUpdateService.exe
Processes 5
  • C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
    "C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"
    Suspicious use of SetThreadContext
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:916
    • C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe
      "C:\Users\Admin\AppData\Local\Temp\b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd.exe"
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 5 /TN "Adobe Service Task Host" /TR "C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe" /F
        Creates scheduled task(s)
        PID:4632
      • C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe
        "C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe
          "C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe"
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          PID:4340
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe

                        MD5

                        855c397b671d85fb2422b31924f8af9f

                        SHA1

                        a2750adf76a245c6f822dc9723e9660b833ca8d4

                        SHA256

                        b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd

                        SHA512

                        921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09

                      • C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe

                        MD5

                        855c397b671d85fb2422b31924f8af9f

                        SHA1

                        a2750adf76a245c6f822dc9723e9660b833ca8d4

                        SHA256

                        b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd

                        SHA512

                        921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09

                      • C:\Users\Admin\AppData\Local\AdobeServiceInstaller\AdobeUpdateService.exe

                        MD5

                        855c397b671d85fb2422b31924f8af9f

                        SHA1

                        a2750adf76a245c6f822dc9723e9660b833ca8d4

                        SHA256

                        b741326d7278ad9d3be13a80bcd3ead02ddb1a45c73d0c3f903d2ae0675643dd

                        SHA512

                        921183d5d9584b256150990fad2d5db8e37065fd1ed03ff7f9d0fd4324ae09da7000037f00e18cd9147b17ae38d2f1f4178d970740598561364b4e61605b3d09

                      • memory/2116-141-0x0000000000000000-mapping.dmp

                      • memory/4340-144-0x0000000000000000-mapping.dmp

                      • memory/4340-145-0x0000000000F00000-0x000000000108B000-memory.dmp

                      • memory/4340-153-0x0000000000F00000-0x000000000108B000-memory.dmp

                      • memory/4632-140-0x0000000000000000-mapping.dmp

                      • memory/5108-131-0x0000000000000000-mapping.dmp

                      • memory/5108-132-0x0000000000800000-0x000000000098B000-memory.dmp

                      • memory/5108-139-0x0000000000800000-0x000000000098B000-memory.dmp