Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe
Resource
win10v2004-20221111-en
General
-
Target
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe
-
Size
17.2MB
-
MD5
9fa1aa9681eba02e7e5dee5619fe5f50
-
SHA1
63dc379b6f25d5c3be14950b7803f8ef89e6baf4
-
SHA256
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909
-
SHA512
a185dc56afbf53b5b99dd30bbfb2fbb1ce35a42cdfd776f338d29d15a2a5712f6458e2a6855e64fa07f26fe6d68fcf92cd178a50f08e60fe24f0ba41848cedc7
-
SSDEEP
196608:kVabKDvhkItVBCfQD+N2xHv2AOrpFRj/QqjZZ42pawiWix1V5dugapRz9GX0eS+B:gvhk0Ykv2AOD9QLcajWinHaXz9G0j
Malware Config
Signatures
-
XMRig Miner payload 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1368-67-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-69-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-71-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-72-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-73-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-75-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-77-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-78-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-79-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-81-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-82-0x00000001402CCBC8-mapping.dmp xmrig behavioral1/memory/1368-84-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-86-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1368-87-0x0000000140000000-0x000000014072E000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 848 services.exe -
Loads dropped DLL 1 IoCs
Processes:
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exepid process 1004 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\services.exe = "C:\\Users\\Admin\\AppData\\Roaming\\services.exe" 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
services.exedescription pid process target process PID 848 set thread context of 1368 848 services.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exepid process 1004 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exeservices.exesvchost.exedescription pid process Token: SeDebugPrivilege 1004 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe Token: SeDebugPrivilege 848 services.exe Token: SeLockMemoryPrivilege 1368 svchost.exe Token: SeLockMemoryPrivilege 1368 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exeservices.exedescription pid process target process PID 1004 wrote to memory of 848 1004 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe services.exe PID 1004 wrote to memory of 848 1004 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe services.exe PID 1004 wrote to memory of 848 1004 283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe services.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe PID 848 wrote to memory of 1368 848 services.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe"C:\Users\Admin\AppData\Local\Temp\283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Roaming\services.exe"C:\Users\Admin\AppData\Roaming\services.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:9000 --user=48gdB7nqr822ep2uWmrQCRGEPVQT1mVdqEcbq83Au47VPFUsv9QRGHQH7B3sXrbe8PbjurFEpLnan4pMqHUUXwsfQAwmDjg --pass= --cpu-max-threads-hint=70 --donate-level=5 --tls --unam-stealth3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\services.exeFilesize
17.2MB
MD59fa1aa9681eba02e7e5dee5619fe5f50
SHA163dc379b6f25d5c3be14950b7803f8ef89e6baf4
SHA256283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909
SHA512a185dc56afbf53b5b99dd30bbfb2fbb1ce35a42cdfd776f338d29d15a2a5712f6458e2a6855e64fa07f26fe6d68fcf92cd178a50f08e60fe24f0ba41848cedc7
-
C:\Users\Admin\AppData\Roaming\services.exeFilesize
17.2MB
MD59fa1aa9681eba02e7e5dee5619fe5f50
SHA163dc379b6f25d5c3be14950b7803f8ef89e6baf4
SHA256283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909
SHA512a185dc56afbf53b5b99dd30bbfb2fbb1ce35a42cdfd776f338d29d15a2a5712f6458e2a6855e64fa07f26fe6d68fcf92cd178a50f08e60fe24f0ba41848cedc7
-
\Users\Admin\AppData\Roaming\services.exeFilesize
17.2MB
MD59fa1aa9681eba02e7e5dee5619fe5f50
SHA163dc379b6f25d5c3be14950b7803f8ef89e6baf4
SHA256283c105c2c82782829e0cea2d161a09d024b914ed1a55cbbe52d2fbf54744909
SHA512a185dc56afbf53b5b99dd30bbfb2fbb1ce35a42cdfd776f338d29d15a2a5712f6458e2a6855e64fa07f26fe6d68fcf92cd178a50f08e60fe24f0ba41848cedc7
-
memory/848-57-0x0000000000000000-mapping.dmp
-
memory/848-60-0x000000013F710000-0x0000000140842000-memory.dmpFilesize
17.2MB
-
memory/848-61-0x00000000009E0000-0x00000000009E8000-memory.dmpFilesize
32KB
-
memory/1004-54-0x000000013F810000-0x0000000140942000-memory.dmpFilesize
17.2MB
-
memory/1004-55-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmpFilesize
8KB
-
memory/1368-69-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-77-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-65-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-67-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-62-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-71-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-72-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-73-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-75-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-63-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-78-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-79-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-81-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-82-0x00000001402CCBC8-mapping.dmp
-
memory/1368-84-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-85-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/1368-86-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1368-87-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB