Analysis

  • max time kernel
    120s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 10:17

General

  • Target

    325cfaf6a3942af25d654ca13cc9f795.exe

  • Size

    20.9MB

  • MD5

    325cfaf6a3942af25d654ca13cc9f795

  • SHA1

    22e35e72c0e4d671f0a08ca8ed81bed6f45e645f

  • SHA256

    cc145daee28e88dfb6b51e77a5d9f29152d4da1f5789b2b3a4d8fcb736543e3b

  • SHA512

    9ad4cfd83818d679dffa4deca0c7b4600330aad6173e60e3d92643763331bcf4602924b8690769c5a078803e9d5e01c9f89b926e43f31497749482f3e7292ccb

  • SSDEEP

    393216:VDWY3GXUqmXRacn2zs/1o2I4/Y0ZZ5cBnK5BPg6azZrPa6bIxPa9XvO:VDWaGXEXRacn2k1oetrco5BPg6azZm6H

Score
9/10

Malware Config

Signatures

  • Detectes Phoenix Miner Payload 1 IoCs
  • Deletes itself 1 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\325cfaf6a3942af25d654ca13cc9f795.exe
    "C:\Users\Admin\AppData\Local\Temp\325cfaf6a3942af25d654ca13cc9f795.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\system32\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\scratch.bat
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\system32\PING.EXE
        ping -n 10 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:2580

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\scratch.bat

          Filesize

          212B

          MD5

          8c8782f67bc6d4823d996cef5d65e5a5

          SHA1

          b1c7659248601845685a89c09575f033c9526f63

          SHA256

          85668bf14ce3846a8b8610306e595e7efd7066d67fdeb75987db44bca21b0817

          SHA512

          011996b197b3e4cd30c705ca934237bc2851e41cb2a68e38ffa71b264084129e91267e19133336c05667e1eee86a868d45af5d480e14d1380517c8efdcd8b1fb

        • C:\Users\Admin\AppData\Roaming\Microsoft\GpuDrive\WmiPrevSE.exe

          Filesize

          10.9MB

          MD5

          acc4d5da6dc251691567d6833b1b56b9

          SHA1

          885b1864ab51cdddec6257087396db2e5e5204a1

          SHA256

          9458075d710c58ac2ff0a14811758c8d91279b3940a71846b0ddedaa580d0042

          SHA512

          81bda2d2e94ea7afdd30329145ef4b67537a639a0d657b838606106a6938f29adf7e21dbc3de5058255d2da3b1efd8e0b3ab1818cc0056a4a905e87b37379638

        • C:\Users\Admin\AppData\Roaming\Microsoft\GpuDrive\WmiPrevSEs.exe

          Filesize

          5.2MB

          MD5

          30ab5838cc15d70fd39faad81f64f712

          SHA1

          1cd9ccc075da933c34acccf7a24445a4ece7dd64

          SHA256

          295b1ea128454f1c9224113d7e074795f545d85a6133bb77aa10fd12f538cb2f

          SHA512

          a7f1b313db71d009afc4444ce458dc5537dc0f544c2138d9ca210a2ac63fa1dc47f6bbb0529c66c1622e1821dfbdec89349320a42100e7ddd484df1c19458378

        • memory/2124-11-0x000007FEFD8D0000-0x000007FEFD8D1000-memory.dmp

          Filesize

          4KB

        • memory/2124-7-0x0000000077990000-0x0000000077991000-memory.dmp

          Filesize

          4KB

        • memory/2124-9-0x000007FEFD8D0000-0x000007FEFD8D1000-memory.dmp

          Filesize

          4KB

        • memory/2124-0-0x0000000140000000-0x0000000142A34000-memory.dmp

          Filesize

          42.2MB

        • memory/2124-13-0x000007FEFD8D0000-0x000007FEFD8D1000-memory.dmp

          Filesize

          4KB

        • memory/2124-16-0x0000000140000000-0x0000000142A34000-memory.dmp

          Filesize

          42.2MB

        • memory/2124-15-0x000007FEFD8D0000-0x000007FEFD8D1000-memory.dmp

          Filesize

          4KB

        • memory/2124-21-0x0000000077990000-0x0000000077991000-memory.dmp

          Filesize

          4KB

        • memory/2124-5-0x0000000077990000-0x0000000077991000-memory.dmp

          Filesize

          4KB

        • memory/2124-3-0x0000000077990000-0x0000000077991000-memory.dmp

          Filesize

          4KB

        • memory/2124-1-0x0000000077990000-0x0000000077991000-memory.dmp

          Filesize

          4KB

        • memory/2124-55-0x0000000140000000-0x0000000142A34000-memory.dmp

          Filesize

          42.2MB