Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-06-2024 00:10

General

  • Target

    d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

  • Size

    424KB

  • MD5

    13e5872e9b7c47090e035dc228c5589f

  • SHA1

    c55a9708091f19b5fc5baf7c37beb99d8d3bf760

  • SHA256

    d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

  • SHA512

    260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

  • SSDEEP

    6144:9O1rkNbOFsBuztTfSoRgxX+j14TGYoij7aR1XPQg9TU5YGmvST3h68BoKupOdCHP:3xBuBTExX+AoLzTUKdvST/BoKupOjUz

Malware Config

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
    "C:\Users\Admin\AppData\Local\Temp\d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4840
      • C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe
        "C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4980
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2412
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1232
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5092
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "YCSDKNAW"
          4⤵
          • Launches sc.exe
          PID:652
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "YCSDKNAW" binpath= "C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe" start= "auto"
          4⤵
          • Launches sc.exe
          PID:3292
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          4⤵
          • Launches sc.exe
          PID:3100
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "YCSDKNAW"
          4⤵
          • Launches sc.exe
          PID:428
  • C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
    C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1412
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1780
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4340
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4068
    • C:\Windows\system32\conhost.exe
      conhost.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1764
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:3812
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:5076
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:4080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe

    Filesize

    2.5MB

    MD5

    fbfbe4ee13baecac3e7d16bec24cf079

    SHA1

    360caf2bb458bee7e65c316099a868b929839d25

    SHA256

    3d65e5f78fa228a79d279fd903b45e584effe6b680d3a3adcb582985de62d01e

    SHA512

    8f5d849e739430cdc560f9dbda5f2f72a07ed0493054298b0d195cf50c972e9a24effdb71cadeea6ced14663fc1268f4a0f45234f37aac334638ffcd8057b28a

  • C:\Users\Admin\AppData\Local\Temp\394516847340

    Filesize

    80KB

    MD5

    a8fdfdf26dcad60f886aec9595dcfd46

    SHA1

    2dbe7159488d60ae981dd7fec3aa28927bcca8ae

    SHA256

    f6d893ead163813295d7ad9f7dfedf20e2fcf9d6a6e9b63d598df857a8d13fcf

    SHA512

    887bd9c3b64bbec30b1fa1b13e117ca7d28da9e8673ef42c80fa8560fb7d0964975edc05229b9af85f23db22e3881b85a5e7cfe1009fd1b698faf48c4023f49d

  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe

    Filesize

    424KB

    MD5

    13e5872e9b7c47090e035dc228c5589f

    SHA1

    c55a9708091f19b5fc5baf7c37beb99d8d3bf760

    SHA256

    d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

    SHA512

    260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

  • memory/1764-43-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-51-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-40-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-41-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-45-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-46-0x000001F29F0D0000-0x000001F29F0F0000-memory.dmp

    Filesize

    128KB

  • memory/1764-44-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-39-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-50-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-42-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-48-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-49-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-47-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-52-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-55-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-56-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/1764-57-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB