Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-03-2024 10:33

General

  • Target

    be62af2560409506f5748556a60d25fbc0b42adb0b56fe08bf6039b61cb6c58d.exe

  • Size

    2.5MB

  • MD5

    4c38070e0764c127692cff709fbfa99e

  • SHA1

    36c85d6658eb285b31d0f20fa60e1e935711cc9f

  • SHA256

    be62af2560409506f5748556a60d25fbc0b42adb0b56fe08bf6039b61cb6c58d

  • SHA512

    b55471879efe435a46297bcd6d21006a03896bba7bbdf6fa39ed694e6aae3651a94e473fef60d50b2964effc05bbb87bc1082ca85872842853dccb2a0df93d7e

  • SSDEEP

    49152:S0+srvwWgzGqpGODg5QQUgbtJHBfHTe3b2UmZZKfCAb:S02GeDgOQUgb9/T67CA

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 16 IoCs
  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be62af2560409506f5748556a60d25fbc0b42adb0b56fe08bf6039b61cb6c58d.exe
    "C:\Users\Admin\AppData\Local\Temp\be62af2560409506f5748556a60d25fbc0b42adb0b56fe08bf6039b61cb6c58d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1488
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "HKQILALP"
      2⤵
      • Launches sc.exe
      PID:1640
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "HKQILALP" binpath= "C:\ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe" start= "auto"
      2⤵
      • Launches sc.exe
      PID:2640
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      2⤵
      • Launches sc.exe
      PID:2824
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "HKQILALP"
      2⤵
      • Launches sc.exe
      PID:2584
  • C:\ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe
    C:\ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\system32\conhost.exe
      C:\Windows\system32\conhost.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2468
      • C:\ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe
        "C:\ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\system32\svchost.exe
          svchost.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1280
    • C:\Windows\system32\svchost.exe
      svchost.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe

    Filesize

    1.4MB

    MD5

    43c657429047cbb3a3e42563a1e612dd

    SHA1

    43043d367c6b0f2c012fc71ff1a81011728e1574

    SHA256

    1200921b5aea66ae2f8e878ad0442ade971a425f7b6b07e6c179b61a995ad153

    SHA512

    918a57ad56914cd7460fa0f1a52a4c99761b44814f80f1493da45c6af83877ca15d5a673f101c050a0fa7da8cc1edc0bf5a2ebd4072f32b32c84f15fb616e6f8

  • C:\Windows\TEMP\kdrefkzgxwho.sys

    Filesize

    14KB

    MD5

    0c0195c48b6b8582fa6f6373032118da

    SHA1

    d25340ae8e92a6d29f599fef426a2bc1b5217299

    SHA256

    11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

    SHA512

    ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

  • \ProgramData\vrlxsdysequq\hhfnvbwmqfna.exe

    Filesize

    2.5MB

    MD5

    4c38070e0764c127692cff709fbfa99e

    SHA1

    36c85d6658eb285b31d0f20fa60e1e935711cc9f

    SHA256

    be62af2560409506f5748556a60d25fbc0b42adb0b56fe08bf6039b61cb6c58d

    SHA512

    b55471879efe435a46297bcd6d21006a03896bba7bbdf6fa39ed694e6aae3651a94e473fef60d50b2964effc05bbb87bc1082ca85872842853dccb2a0df93d7e

  • memory/1280-40-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-41-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-47-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-46-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-43-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-39-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-38-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1280-48-0x0000000000110000-0x0000000000130000-memory.dmp

    Filesize

    128KB

  • memory/1280-50-0x0000000000110000-0x0000000000130000-memory.dmp

    Filesize

    128KB

  • memory/2468-4-0x0000000140000000-0x000000014000D000-memory.dmp

    Filesize

    52KB

  • memory/2468-8-0x0000000140000000-0x000000014000D000-memory.dmp

    Filesize

    52KB

  • memory/2468-11-0x0000000140000000-0x000000014000D000-memory.dmp

    Filesize

    52KB

  • memory/2468-5-0x0000000140000000-0x000000014000D000-memory.dmp

    Filesize

    52KB

  • memory/2468-7-0x0000000140000000-0x000000014000D000-memory.dmp

    Filesize

    52KB

  • memory/2468-6-0x0000000140000000-0x000000014000D000-memory.dmp

    Filesize

    52KB

  • memory/2800-16-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-20-0x0000000000040000-0x0000000000060000-memory.dmp

    Filesize

    128KB

  • memory/2800-32-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-28-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-29-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-15-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-17-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-12-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-42-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-14-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-44-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-45-0x0000000000780000-0x00000000007A0000-memory.dmp

    Filesize

    128KB

  • memory/2800-19-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-18-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-31-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/2800-49-0x0000000000780000-0x00000000007A0000-memory.dmp

    Filesize

    128KB

  • memory/2800-34-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB