Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 10:29
Static task
static1
Behavioral task
behavioral1
Sample
ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe
Resource
win7-20220414-en
General
-
Target
ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe
-
Size
1.1MB
-
MD5
0c218ef7f1dd22804e307ce6b9965e2f
-
SHA1
63500daa7edee18a57d6ac649a6743e95591d591
-
SHA256
ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7
-
SHA512
5ee16ee9c3cd397da493bb3f87aead7ee0b9bf3d6274d71ae0be6902d83242a7080821371d44b2a5ac06ec66c1a2037a4763dfc9f1b853a330f3fe2ba9138e4e
Malware Config
Signatures
-
XMRig Miner Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-60-0x0000000000130000-0x0000000000256000-memory.dmp xmrig behavioral1/memory/1688-61-0x0000000000620000-0x0000000000752000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
loader.exepid process 2004 loader.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1236 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
loader.exepid process 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe 2004 loader.exe -
Suspicious use of AdjustPrivilegeToken 29 IoCs
Processes:
ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exesvchost.exeloader.exedescription pid process Token: SeIncBasePriorityPrivilege 1600 ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe Token: SeLockMemoryPrivilege 1688 svchost.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe Token: SeDebugPrivilege 2004 loader.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
loader.exeddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.execmd.exedescription pid process target process PID 2004 wrote to memory of 1688 2004 loader.exe svchost.exe PID 2004 wrote to memory of 1688 2004 loader.exe svchost.exe PID 2004 wrote to memory of 1688 2004 loader.exe svchost.exe PID 2004 wrote to memory of 1688 2004 loader.exe svchost.exe PID 2004 wrote to memory of 1688 2004 loader.exe svchost.exe PID 2004 wrote to memory of 1688 2004 loader.exe svchost.exe PID 1600 wrote to memory of 1236 1600 ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe cmd.exe PID 1600 wrote to memory of 1236 1600 ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe cmd.exe PID 1600 wrote to memory of 1236 1600 ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe cmd.exe PID 1600 wrote to memory of 1236 1600 ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe cmd.exe PID 1236 wrote to memory of 1616 1236 cmd.exe PING.EXE PID 1236 wrote to memory of 1616 1236 cmd.exe PING.EXE PID 1236 wrote to memory of 1616 1236 cmd.exe PING.EXE PID 1236 wrote to memory of 1616 1236 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe"C:\Users\Admin\AppData\Local\Temp\ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @ping -n 15 127.0.0.1&del C:\Users\Admin\AppData\Local\Temp\DDC80D~1.EXE > nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 15 127.0.0.13⤵
- Runs ping.exe
-
C:\ProgramData\WinTcpAutoProxySvc\loader.exeC:\ProgramData\WinTcpAutoProxySvc\loader.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exe"C:\Windows\sysnative\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\WinTcpAutoProxySvc\loader.exeFilesize
1.1MB
MD50c218ef7f1dd22804e307ce6b9965e2f
SHA163500daa7edee18a57d6ac649a6743e95591d591
SHA256ddc80d32cf7a231befcc58230707f111a47c6825a98f43dd2fb3edc4d142e0f7
SHA5125ee16ee9c3cd397da493bb3f87aead7ee0b9bf3d6274d71ae0be6902d83242a7080821371d44b2a5ac06ec66c1a2037a4763dfc9f1b853a330f3fe2ba9138e4e
-
memory/1236-57-0x0000000000000000-mapping.dmp
-
memory/1600-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1616-59-0x0000000000000000-mapping.dmp
-
memory/1688-58-0x00000000000A0000-0x00000000000B0000-memory.dmpFilesize
64KB
-
memory/1688-60-0x0000000000130000-0x0000000000256000-memory.dmpFilesize
1.1MB
-
memory/1688-62-0x0000000000260000-0x0000000000264000-memory.dmpFilesize
16KB
-
memory/1688-61-0x0000000000620000-0x0000000000752000-memory.dmpFilesize
1.2MB