Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 16:30
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe
Resource
win7-20240729-en
General
-
Target
2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe
-
Size
4.1MB
-
MD5
c3501d6ff82593562de8ad0eb339bbf1
-
SHA1
8550a5874e04ed2ff938897b0606b0783e064742
-
SHA256
fd3ff17c545781d97334e0f46dfef983422e0dfe33e5636929110183e75af683
-
SHA512
97df414e62d4d33d5badd312851bd096e62218b8f437d5cd82a9577bde4b11c4c82e4cadc32c771f38f8afc802b6a9be56e2eb749316c15444e3c530530c2868
-
SSDEEP
49152:OFFmvojGT33XCMB8D1XqayZsdWT23+1WNYmHhKEcAMJJSq/jqnC0G/yRKEYNXbJt:wFm8yNayecTdR/E7IJwCyRKE09pa/3I
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/3144-21-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-23-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-20-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-25-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-24-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-26-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-27-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-28-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-30-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-31-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/3144-32-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 2 IoCs
pid Process 5064 838abd59e3764004.exe 820 qshtkbttphgg.exe -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1948 powercfg.exe 1900 powercfg.exe 1420 powercfg.exe 1536 powercfg.exe 2928 powercfg.exe 1776 powercfg.exe 3612 powercfg.exe 3604 powercfg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 820 set thread context of 708 820 qshtkbttphgg.exe 122 PID 820 set thread context of 3144 820 qshtkbttphgg.exe 126 -
resource yara_rule behavioral2/memory/3144-16-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-15-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-17-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-18-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-21-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-23-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-20-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-19-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-25-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-24-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-26-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-27-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-28-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-30-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-31-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/3144-32-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2980 sc.exe 2688 sc.exe 4476 sc.exe 4148 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fltmc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 5064 838abd59e3764004.exe 820 qshtkbttphgg.exe 820 qshtkbttphgg.exe 820 qshtkbttphgg.exe 820 qshtkbttphgg.exe 820 qshtkbttphgg.exe 820 qshtkbttphgg.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 5064 838abd59e3764004.exe Token: SeShutdownPrivilege 1900 powercfg.exe Token: SeCreatePagefilePrivilege 1900 powercfg.exe Token: SeShutdownPrivilege 1420 powercfg.exe Token: SeCreatePagefilePrivilege 1420 powercfg.exe Token: SeShutdownPrivilege 1536 powercfg.exe Token: SeCreatePagefilePrivilege 1536 powercfg.exe Token: SeShutdownPrivilege 1948 powercfg.exe Token: SeCreatePagefilePrivilege 1948 powercfg.exe Token: SeDebugPrivilege 820 qshtkbttphgg.exe Token: SeShutdownPrivilege 3612 powercfg.exe Token: SeCreatePagefilePrivilege 3612 powercfg.exe Token: SeShutdownPrivilege 1776 powercfg.exe Token: SeCreatePagefilePrivilege 1776 powercfg.exe Token: SeShutdownPrivilege 2928 powercfg.exe Token: SeCreatePagefilePrivilege 2928 powercfg.exe Token: SeShutdownPrivilege 3604 powercfg.exe Token: SeCreatePagefilePrivilege 3604 powercfg.exe Token: SeLockMemoryPrivilege 3144 explorer.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3672 wrote to memory of 748 3672 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 84 PID 3672 wrote to memory of 748 3672 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 84 PID 3672 wrote to memory of 748 3672 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 84 PID 3672 wrote to memory of 5064 3672 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 96 PID 3672 wrote to memory of 5064 3672 2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe 96 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 708 820 qshtkbttphgg.exe 122 PID 820 wrote to memory of 3144 820 qshtkbttphgg.exe 126 PID 820 wrote to memory of 3144 820 qshtkbttphgg.exe 126 PID 820 wrote to memory of 3144 820 qshtkbttphgg.exe 126 PID 820 wrote to memory of 3144 820 qshtkbttphgg.exe 126 PID 820 wrote to memory of 3144 820 qshtkbttphgg.exe 126
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-25_c3501d6ff82593562de8ad0eb339bbf1_snatch.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\fltmc.exefltmc2⤵
- System Location Discovery: System Language Discovery
PID:748
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\838abd59e3764004.exeC:\Users\Admin\AppData\Roaming\Microsoft\838abd59e3764004.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5064 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "AHMOQNZH"3⤵
- Launches sc.exe
PID:2688
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "AHMOQNZH" binpath= "C:\ProgramData\ipbodjvyupmv\qshtkbttphgg.exe" start= "auto"3⤵
- Launches sc.exe
PID:4476
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:4148
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "AHMOQNZH"3⤵
- Launches sc.exe
PID:2980
-
-
-
C:\ProgramData\ipbodjvyupmv\qshtkbttphgg.exeC:\ProgramData\ipbodjvyupmv\qshtkbttphgg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:708
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5a5c4e57922031e587bf09fb90453d73e
SHA14bc3a265800ef4f7df8402292d8218553b2860b6
SHA2563720ffed8da2ba9d4cabbe64331f939f36e750e7dd3d5b9ff4d937325b35543b
SHA5120fd81c9ca1ea8587fa33f2da3f45896b9d22e9f8a014513316274674a4256a4f04654462ed4ed87021e999964c895734aa2814e5a37f23a2010c594ad113a491