Overview

overview

10

Static

static

618a1e3551...29.exe

windows7_x64

10

618a1e3551...29.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    618a1e3551560b86454450f3ea580029.exe

  • Size

    584KB

  • Sample

    200630-mw6ctwedfe

  • MD5

    618a1e3551560b86454450f3ea580029

  • SHA1

    39d86228750d1eebdb78f60b03c3b638acf72d34

  • SHA256

    6edb794a9f28cbd60dcb9fefc0e145f64c9e623b3df235a4a907ca948fd1edb9

  • SHA512

    d5b309a0ff9b07e74c9cee1df37a627193393de7cc0fe079ab606d94b2beac948c8d7d25378de3cf87b00c7227c70fa8e49291d6060a7254e2ce0439a09c2305

Score
10/10
evasionminerpersistence

Malware Config

Targets

    • Target

      618a1e3551560b86454450f3ea580029.exe

    • Size

      584KB

    • MD5

      618a1e3551560b86454450f3ea580029

    • SHA1

      39d86228750d1eebdb78f60b03c3b638acf72d34

    • SHA256

      6edb794a9f28cbd60dcb9fefc0e145f64c9e623b3df235a4a907ca948fd1edb9

    • SHA512

      d5b309a0ff9b07e74c9cee1df37a627193393de7cc0fe079ab606d94b2beac948c8d7d25378de3cf87b00c7227c70fa8e49291d6060a7254e2ce0439a09c2305

    Score
    10/10
    persistenceevasionminer

    • Modifies WinLogon for persistence

      persistence

    • Detected Stratum cryptominer command

      Looks to be attempting to contact Stratum mining pool.

      miner

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Modifies service

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

New Service

1
T1050

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks