Resubmissions
27-01-2023 19:10
230127-xvglescg25 1027-01-2023 17:57
230127-wjv41adg9z 1027-01-2023 17:47
230127-wcvjwsdg7x 10Analysis
-
max time kernel
151s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-01-2023 17:57
Static task
static1
Behavioral task
behavioral1
Sample
Doge-Miner203.exe
Resource
win7-20221111-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Doge-Miner203.exe
Resource
win10v2004-20220812-en
9 signatures
150 seconds
General
-
Target
Doge-Miner203.exe
-
Size
6.1MB
-
MD5
d7e6fd264bc937e3646de58e551a29db
-
SHA1
1db4664777b17e004f71cee4002f9ccc430413e4
-
SHA256
463d5d683ca55e95f8701d36543d6208fae366e065bc71fe663351450a4f8c24
-
SHA512
cc133bd0599c0a994c65c2ddc047dd7bec3d4032201feba63ac8f4a35582a31f2eed5d3bfe385fefda7e76d3e95415b1ccf1923a9b74a1792dc36c8f7caee837
-
SSDEEP
98304:tGFp32YKbG4vUdQUbSZ/I2jeYXyxd4494Wc9f:tEMbqQ5Z/pjVifXuT
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\notepad.exe," reg.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 392 PING.EXE 880 PING.EXE 1060 PING.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
Doge-Miner203.exepid process 1256 Doge-Miner203.exe 1256 Doge-Miner203.exe 1256 Doge-Miner203.exe 1256 Doge-Miner203.exe 1256 Doge-Miner203.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Doge-Miner203.exedescription pid process Token: SeDebugPrivilege 1256 Doge-Miner203.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Doge-Miner203.execmd.execmd.exedescription pid process target process PID 1256 wrote to memory of 1488 1256 Doge-Miner203.exe cmd.exe PID 1256 wrote to memory of 1488 1256 Doge-Miner203.exe cmd.exe PID 1256 wrote to memory of 1488 1256 Doge-Miner203.exe cmd.exe PID 1256 wrote to memory of 1488 1256 Doge-Miner203.exe cmd.exe PID 1488 wrote to memory of 880 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 880 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 880 1488 cmd.exe PING.EXE PID 1488 wrote to memory of 880 1488 cmd.exe PING.EXE PID 1256 wrote to memory of 1520 1256 Doge-Miner203.exe cmd.exe PID 1256 wrote to memory of 1520 1256 Doge-Miner203.exe cmd.exe PID 1256 wrote to memory of 1520 1256 Doge-Miner203.exe cmd.exe PID 1256 wrote to memory of 1520 1256 Doge-Miner203.exe cmd.exe PID 1520 wrote to memory of 1060 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 1060 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 1060 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 1060 1520 cmd.exe PING.EXE PID 1488 wrote to memory of 1860 1488 cmd.exe reg.exe PID 1488 wrote to memory of 1860 1488 cmd.exe reg.exe PID 1488 wrote to memory of 1860 1488 cmd.exe reg.exe PID 1488 wrote to memory of 1860 1488 cmd.exe reg.exe PID 1520 wrote to memory of 392 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 392 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 392 1520 cmd.exe PING.EXE PID 1520 wrote to memory of 392 1520 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doge-Miner203.exe"C:\Users\Admin\AppData\Local\Temp\Doge-Miner203.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\notepad.exe,"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\notepad.exe,"3⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 37 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Doge-Miner203.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\notepad.exe" && ping 127.0.0.1 -n 37 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\notepad.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 373⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 373⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-63-0x0000000000000000-mapping.dmp
-
memory/880-59-0x0000000000000000-mapping.dmp
-
memory/1060-61-0x0000000000000000-mapping.dmp
-
memory/1256-54-0x0000000000B10000-0x000000000112A000-memory.dmpFilesize
6.1MB
-
memory/1256-55-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1256-56-0x0000000000460000-0x0000000000490000-memory.dmpFilesize
192KB
-
memory/1256-57-0x0000000000390000-0x00000000003A8000-memory.dmpFilesize
96KB
-
memory/1488-58-0x0000000000000000-mapping.dmp
-
memory/1520-60-0x0000000000000000-mapping.dmp
-
memory/1860-62-0x0000000000000000-mapping.dmp