Overview

overview

10

Static

static

10

f69025c398...4f.exe

windows7_x64

10

f69025c398...4f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    82s
  • max time network
    207s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 02:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f69025c3989bcf53faa23fb240fc6710ab36ed36c13b5c2fa78c8725772dbe4f.exe

  • Size

    1.1MB

  • MD5

    35b94119f76089e8937496e6942fb9dd

  • SHA1

    8cc1318e56d7f57ac2c1f62ebfffdd2ad68c4d7c

  • SHA256

    f69025c3989bcf53faa23fb240fc6710ab36ed36c13b5c2fa78c8725772dbe4f

  • SHA512

    d899970fbb9dc843def051d03830cc76a27b9ea4fab9b4785eba901a45d85d1db91cfa2d7f2e7458a1353636a98d012842e831f34e6b2c7fc69e43d0db150348

Score
10/10
xmrigminerpersistence

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detected Stratum cryptominer command

    Looks to be attempting to contact Stratum mining pool.

    miner
  • XMRig Miner Payload 2 IoCs
    miner
  • Executes dropped EXE 1 IoCs
  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f69025c3989bcf53faa23fb240fc6710ab36ed36c13b5c2fa78c8725772dbe4f.exe
    "C:\Users\Admin\AppData\Local\Temp\f69025c3989bcf53faa23fb240fc6710ab36ed36c13b5c2fa78c8725772dbe4f.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Roaming\Sysfiles\AudioDriver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\AudioDriver.exe" -o stratum+tcp://xmr.pool.minergate.com:45700 -u [email protected] -p x -k -v=0 --donate-level=1 -t 1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:880

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Sysfiles\AudioDriver.exe
    Filesize

    1.1MB

    MD5

    bc74901be1f64e4270fae0712f61a7ec

    SHA1

    432d40540405b9b5f55077fb4fea11d1d7bdeaed

    SHA256

    cb3c5619a8391f989c6a69135d890c3126eda9841b9dc591d44f02078a6fd49b

    SHA512

    d9289839db70d4f60ef1096b5fb0551f5f3a3b5b8e93cdb7c157b40a43f3d1986849850c1d44dff67a6a33275a6692c0209906eba83a2f93016ac1f73cf92344

    Download Submit

  • \Users\Admin\AppData\Roaming\Sysfiles\AudioDriver.exe
    Filesize

    1.1MB

    MD5

    bc74901be1f64e4270fae0712f61a7ec

    SHA1

    432d40540405b9b5f55077fb4fea11d1d7bdeaed

    SHA256

    cb3c5619a8391f989c6a69135d890c3126eda9841b9dc591d44f02078a6fd49b

    SHA512

    d9289839db70d4f60ef1096b5fb0551f5f3a3b5b8e93cdb7c157b40a43f3d1986849850c1d44dff67a6a33275a6692c0209906eba83a2f93016ac1f73cf92344

    Download Submit

  • memory/1988-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1988-55-0x0000000074880000-0x0000000074E2B000-memory.dmp

    Filesize

    5.7MB

    Download