Analysis
-
max time kernel
170s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-05-2022 05:35
General
-
Target
mine2.exe
-
Size
810KB
-
MD5
be75e9e51767b5a59536afbbf9ffafbc
-
SHA1
78be65d86a6918643092e8e90fd72ad3b9ab997f
-
SHA256
30a4788b9d7eb3c50403737f4af3882b79ba75b8201d53aefb359336f5763745
-
SHA512
4e9f7198dd12adeb21669f74e1cdebe16ac7ccae8e1f29b537438239d1a240a8f1ab890afebe8c1f8603909a1c72b8ce7e7c981f2147fa53dccc6c43b6a3d9e6
Malware Config
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mine2.exe"C:\Users\Admin\AppData\Local\Temp\mine2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /create /tn HGRAyZk0Y950ZeEUrPGcT36so /tr "C:\ProgramData\test\test.exe" /st 07:49 /du 23:59 /sc daily /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\test\test.exe"C:\ProgramData\test\test.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4683.tmp.bat""2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 63⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392.3MB
MD51c12c8029fef7dd26aa443e584372065
SHA1939a46772c8692b530d213e1f29c1926228c3f4e
SHA25607011eb80ce4ba092a6231378d72d12625e83bbc35fe6e98b4733b75b971c6de
SHA512685308da19e82e3c13528143f4c0d5b013299acee0efba3312a14cef49805cff97820fe5d78e45b333b32601f9f1dda23a7ffd1437d3a7495d75a2b24bee9b6d
-
Filesize
380.0MB
MD5a6d3220d77f7762164226392881835c4
SHA18d3ae8e66c167fbae6574bf17831948612299d3d
SHA2566953d3c3376dbd650522a1a91470349d2890fc85e9099497d8540d5828355924
SHA5124d31969c32d564101aeb07e09ac7d436f2e81a5066c7dc205cc152c6312de47f3a9de34e1b15f1889d5722641d94a19dba0aec958f9b0748662fb79d2c5041e7
-
Filesize
157B
MD5862f63501190f5bd47c34081629e4228
SHA1cc6d2fe151a857d0178e319dba2099370670c2ed
SHA25648dd72786889aec00635e701c1512c35b458410a0b04a40ca380a6810e389a02
SHA512e1e80309854250c17834321391d05e69fe3efdd4f174b9164019b97d7eee80a22f836fd5f14fc8495ca54a47697332d51e8d8157f7182e6a2f4e917f65d3f37c
-
Filesize
401.5MB
MD5c5787f0037bc957d216dd8b5da801f22
SHA11c6077e31cf55b6077aa9f3fc14232d3ae19489b
SHA25697463f0942f958cb788b6a78d7c013e9ebad3e0cc527ac6addd9d9d496975fd7
SHA5128c5f34800ae85b8ec956f546f578636857d3b67ac1f910a7ecb8fd27fd13473888e9bebffe59244b8e3b873cd467b7587735743bf7ea3b138ab6cc6b9f08ee39
-
Filesize
824KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
824KB
-
Filesize
24KB
-
Filesize
856KB