Analysis

  • max time kernel
    298s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-06-2024 05:10

General

  • Target

    d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe

  • Size

    424KB

  • MD5

    13e5872e9b7c47090e035dc228c5589f

  • SHA1

    c55a9708091f19b5fc5baf7c37beb99d8d3bf760

  • SHA256

    d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

  • SHA512

    260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

  • SSDEEP

    6144:9O1rkNbOFsBuztTfSoRgxX+j14TGYoij7aR1XPQg9TU5YGmvST3h68BoKupOdCHP:3xBuBTExX+AoLzTUKdvST/BoKupOjUz

Malware Config

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe
    "C:\Users\Admin\AppData\Local\Temp\d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe
        "C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4620
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4588
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4752
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4220
        • C:\Windows\system32\powercfg.exe
          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:864
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe delete "YCSDKNAW"
          4⤵
          • Launches sc.exe
          PID:512
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe create "YCSDKNAW" binpath= "C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe" start= "auto"
          4⤵
          • Launches sc.exe
          PID:4420
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop eventlog
          4⤵
          • Launches sc.exe
          PID:4544
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe start "YCSDKNAW"
          4⤵
          • Launches sc.exe
          PID:4124
  • C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
    C:\ProgramData\anoomxjjawjf\vxfagazdltye.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2896
    • C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4308
    • C:\Windows\system32\conhost.exe
      conhost.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4496
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:3668
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:932
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:1208
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:4396
  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe
    1⤵
    • Executes dropped EXE
    PID:4368

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1000001001\blob.exe

    Filesize

    2.5MB

    MD5

    fbfbe4ee13baecac3e7d16bec24cf079

    SHA1

    360caf2bb458bee7e65c316099a868b929839d25

    SHA256

    3d65e5f78fa228a79d279fd903b45e584effe6b680d3a3adcb582985de62d01e

    SHA512

    8f5d849e739430cdc560f9dbda5f2f72a07ed0493054298b0d195cf50c972e9a24effdb71cadeea6ced14663fc1268f4a0f45234f37aac334638ffcd8057b28a

  • C:\Users\Admin\AppData\Local\Temp\5641a448ac\Hkbsse.exe

    Filesize

    424KB

    MD5

    13e5872e9b7c47090e035dc228c5589f

    SHA1

    c55a9708091f19b5fc5baf7c37beb99d8d3bf760

    SHA256

    d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc

    SHA512

    260671baa8f30e2364b21ab0a9cd3d8a104f76032ebfd3684150d8c318b9cb759b246ae8df25274e864053a6d55bdb77e028452b1d91999b37efc291f8ee815e

  • C:\Users\Admin\AppData\Local\Temp\699363923187

    Filesize

    66KB

    MD5

    06c6553ad85d6a071483b0ec74f86e65

    SHA1

    c59416e40c7e98cf7b4478514cf01b4b7774cfbd

    SHA256

    7b0d36f377d53a4275f36f0019ac92517e8f57cf2cf61cfb4c2bcc4fccd95a76

    SHA512

    4eb21dae26829d70a7a9f02a9bfd23575cc75c524d40db58e4866fc0e8464ab8a61ea2de286dd115882c474b015e311bd9263d6ecfd3c7ff6b89ad3770e49edf

  • memory/4496-43-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-41-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-34-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-38-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-40-0x00000217674C0000-0x00000217674E0000-memory.dmp

    Filesize

    128KB

  • memory/4496-45-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-44-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-33-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-42-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-36-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-39-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-37-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-35-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-48-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-50-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-52-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB

  • memory/4496-51-0x0000000140000000-0x0000000140848000-memory.dmp

    Filesize

    8.3MB