Analysis
- max time kernel
178s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-20220721-en - resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system - submitted
02/08/2022, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe
Resource
win7-20220718-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe
- Size 890KB
- Sample220802-aa5fesbgfn
- SHA256 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e
- MD5 39235e9dc0c41d1c834311205707decb
- SHA1 fbd32d7135ef784e94b8b0271b846392f7dce36e
- SHA512 93cb831f6c1a085741fc8e70dd19ac37d3a76e7b3d5a0f6798c6c8ae8e4e1b3ceb9d88be16438739f31528baa272179c4d0f07aad3668d73c8f090ee10114001
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\holystone.exe" msiexec.exe - XMRig Miner payload 3 IoCs
resource yara_rule behavioral2/memory/528-144-0x0000000000400000-0x00000000004ED000-memory.dmp xmrig behavioral2/memory/528-146-0x0000000000400000-0x00000000004ED000-memory.dmp xmrig behavioral2/memory/528-147-0x0000000000400000-0x00000000004ED000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/528-140-0x0000000000400000-0x00000000004ED000-memory.dmp upx behavioral2/memory/528-142-0x0000000000400000-0x00000000004ED000-memory.dmp upx behavioral2/memory/528-143-0x0000000000400000-0x00000000004ED000-memory.dmp upx behavioral2/memory/528-144-0x0000000000400000-0x00000000004ED000-memory.dmp upx behavioral2/memory/528-146-0x0000000000400000-0x00000000004ED000-memory.dmp upx - Loads dropped DLL 3 IoCs
pid Process 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1880 set thread context of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 2756 set thread context of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe Token: SeLockMemoryPrivilege 528 notepad.exe Token: SeLockMemoryPrivilege 528 notepad.exe - Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1880 wrote to memory of 3348 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 84 PID 1880 wrote to memory of 3348 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 84 PID 1880 wrote to memory of 3348 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 84 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 3348 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 84 PID 1880 wrote to memory of 3348 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 84 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 1880 wrote to memory of 2756 1880 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 85 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86 PID 2756 wrote to memory of 528 2756 5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe"C:\Users\Admin\AppData\Local\Temp\5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- Modifies WinLogon for persistence
PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe"C:\Users\Admin\AppData\Local\Temp\5b5fb7165b3b08c4bb203335cca2a8b10863ce3624ea5382771092967660a14e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\sHrhJDaCBu\cfgi"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\sHrhJDaCBu\cfgi
- Size 548B
- SHA256 503f536489bc9e69e8f472786690a4da9f69a293fe1788d1165eff0cc90ae01d
- MD5 d84b60d37ea5e8fdb8f69f872f77ed5f
- SHA1 6dd312b42ebd731f96f4580d687bb2125d9ddb4b
- SHA512 819d2b0504dab5556c9a8d8be473fcebf48e367220e4a019b4ff422c9c9ecb6d14fc3e6ea840e2d9294f541e8110241af61bc401840668bc8071890336560960
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Hottentot.dll
- Size 68KB
- SHA256 d7f58fd413f4976dace7b5e6c4c5dd5987a9d919e7c050052060c30a7d169b34
- MD5 bebddeb593fa1302cea66faac25a9e3c
- SHA1 9e8cce6ffa83fdc147b6dc83811db52d20261191
- SHA512 0e18ca3bd3c01c6b80301c83c9d964607e5df21bf5536e6f332b9cf84cc9a7c100a8a47deebd9ced8fbefd61549df13473139a2f23f3b98df2ba9f54c6c6fc6a
- SSDEEP 1536:Q9xsZp0UAHEKvwmL2ChPMAJLZ8gYvON+EwgvpFq:Q9230TEy7l14ON+gFq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Hottentot.dll
- Size 68KB
- SHA256 d7f58fd413f4976dace7b5e6c4c5dd5987a9d919e7c050052060c30a7d169b34
- MD5 bebddeb593fa1302cea66faac25a9e3c
- SHA1 9e8cce6ffa83fdc147b6dc83811db52d20261191
- SHA512 0e18ca3bd3c01c6b80301c83c9d964607e5df21bf5536e6f332b9cf84cc9a7c100a8a47deebd9ced8fbefd61549df13473139a2f23f3b98df2ba9f54c6c6fc6a
- SSDEEP 1536:Q9xsZp0UAHEKvwmL2ChPMAJLZ8gYvON+EwgvpFq:Q9230TEy7l14ON+gFq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsa4799.tmp\System.dll
- Size 11KB
- SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
- MD5 SHA1 SHA512 SSDEEP