Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 16:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe
Resource
win7-20240729-en
General
-
Target
2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe
-
Size
4.1MB
-
MD5
c3501d6ff82593562de8ad0eb339bbf1
-
SHA1
8550a5874e04ed2ff938897b0606b0783e064742
-
SHA256
fd3ff17c545781d97334e0f46dfef983422e0dfe33e5636929110183e75af683
-
SHA512
97df414e62d4d33d5badd312851bd096e62218b8f437d5cd82a9577bde4b11c4c82e4cadc32c771f38f8afc802b6a9be56e2eb749316c15444e3c530530c2868
-
SSDEEP
49152:OFFmvojGT33XCMB8D1XqayZsdWT23+1WNYmHhKEcAMJJSq/jqnC0G/yRKEYNXbJt:wFm8yNayecTdR/E7IJwCyRKE09pa/3I
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 9 IoCs
resource yara_rule behavioral1/memory/2928-26-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-31-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-33-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-30-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-32-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-29-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-27-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-34-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral1/memory/2928-35-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 3 IoCs
pid Process 2800 a7de7ae48ea63571.exe 472 Process not Found 3024 qshtkbttphgg.exe -
Loads dropped DLL 3 IoCs
pid Process 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 472 Process not Found -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2736 powercfg.exe 2420 powercfg.exe 2784 powercfg.exe 3036 powercfg.exe 2512 powercfg.exe 2360 powercfg.exe 2832 powercfg.exe 2796 powercfg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3024 set thread context of 1912 3024 qshtkbttphgg.exe 55 PID 3024 set thread context of 2928 3024 qshtkbttphgg.exe 59 -
resource yara_rule behavioral1/memory/2928-22-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-26-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-31-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-33-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-30-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-32-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-29-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-23-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-27-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-25-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-21-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-24-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-34-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral1/memory/2928-35-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2788 sc.exe 2720 sc.exe 2564 sc.exe 2544 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fltmc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 2800 a7de7ae48ea63571.exe 3024 qshtkbttphgg.exe 3024 qshtkbttphgg.exe 3024 qshtkbttphgg.exe 3024 qshtkbttphgg.exe 3024 qshtkbttphgg.exe 3024 qshtkbttphgg.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2800 a7de7ae48ea63571.exe Token: SeShutdownPrivilege 2796 powercfg.exe Token: SeShutdownPrivilege 2736 powercfg.exe Token: SeShutdownPrivilege 2420 powercfg.exe Token: SeShutdownPrivilege 2784 powercfg.exe Token: SeDebugPrivilege 3024 qshtkbttphgg.exe Token: SeShutdownPrivilege 2512 powercfg.exe Token: SeShutdownPrivilege 2832 powercfg.exe Token: SeShutdownPrivilege 2360 powercfg.exe Token: SeShutdownPrivilege 3036 powercfg.exe Token: SeLockMemoryPrivilege 2928 explorer.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2164 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 31 PID 2848 wrote to memory of 2164 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 31 PID 2848 wrote to memory of 2164 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 31 PID 2848 wrote to memory of 2164 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 31 PID 2848 wrote to memory of 2800 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 33 PID 2848 wrote to memory of 2800 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 33 PID 2848 wrote to memory of 2800 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 33 PID 2848 wrote to memory of 2800 2848 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 33 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 1912 3024 qshtkbttphgg.exe 55 PID 3024 wrote to memory of 2928 3024 qshtkbttphgg.exe 59 PID 3024 wrote to memory of 2928 3024 qshtkbttphgg.exe 59 PID 3024 wrote to memory of 2928 3024 qshtkbttphgg.exe 59 PID 3024 wrote to memory of 2928 3024 qshtkbttphgg.exe 59 PID 3024 wrote to memory of 2928 3024 qshtkbttphgg.exe 59
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\fltmc.exefltmc2⤵
- System Location Discovery: System Language Discovery
PID:2164
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\a7de7ae48ea63571.exeC:\Users\Admin\AppData\Roaming\Microsoft\a7de7ae48ea63571.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2800 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "AHMOQNZH"3⤵
- Launches sc.exe
PID:2788
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "AHMOQNZH" binpath= "C:\ProgramData\ipbodjvyupmv\qshtkbttphgg.exe" start= "auto"3⤵
- Launches sc.exe
PID:2720
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:2544
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "AHMOQNZH"3⤵
- Launches sc.exe
PID:2564
-
-
-
C:\ProgramData\ipbodjvyupmv\qshtkbttphgg.exeC:\ProgramData\ipbodjvyupmv\qshtkbttphgg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1912
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5a5c4e57922031e587bf09fb90453d73e
SHA14bc3a265800ef4f7df8402292d8218553b2860b6
SHA2563720ffed8da2ba9d4cabbe64331f939f36e750e7dd3d5b9ff4d937325b35543b
SHA5120fd81c9ca1ea8587fa33f2da3f45896b9d22e9f8a014513316274674a4256a4f04654462ed4ed87021e999964c895734aa2814e5a37f23a2010c594ad113a491