Analysis date (UTC): 11 May 2020, 18:33Analysis environment: Windows 7 Pro, build 7601, x86

64.exe

MD5:7979220890E32DFF3F13246176430601

SHA1:A72EB0E301DFFF293AAB908912269E59FA914C5D

SHA256:536C8111C7702589AA90108EFBBDACC2798F3CC44FAD8480401C8EBA3A6306D0

Analysis result

Threat level:Malicious activity

Tags:

loaderminertrojan

Full analysis:Analysis 64.exe (MD5: 7979220890E32DFF3F13246176430601) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Runs PING.EXE for delay simulation

cmd.exe (PID: 2700)

Downloads executable files from the Internet

chrome.exe (PID: 3876)

Application was dropped or rewritten from another process

service.exe (PID: 1452)
service.exe (PID: 4036)
service.exe (PID: 676)
service.exe (PID: 5560)
d1lhots.exe (PID: 5116)

Starts NET.EXE for service management

service.exe (PID: 1452)
service.exe (PID: 4036)
service.exe (PID: 676)
service.exe (PID: 5560)
conhost.exe (PID: 4420)

Uses TASKKILL.EXE to kill security tools

cmd.exe (PID: 5536)
cmd.exe (PID: 5520)

Looks like application has launched a miner

conhost.exe (PID: 4420)
svchost.exe (PID: 4700)

Tries to delete the host file

cmd.exe (PID: 4632)

Writes to the hosts file

cmd.exe (PID: 4632)

MINER was detected

d1lhots.exe (PID: 5116)

Connects to CnC server

d1lhots.exe (PID: 5116)

SUSPICIOUS

Starts CMD.EXE for self-deleting

64.exe (PID: 2428)

Uses REG.EXE to modify Windows registry

cmd.exe (PID: 3848)
cmd.exe (PID: 2784)
cmd.exe (PID: 3292)
cmd.exe (PID: 4632)

Starts SC.EXE for service management

cmd.exe (PID: 3848)
service.exe (PID: 1452)
service.exe (PID: 4036)
service.exe (PID: 676)
cmd.exe (PID: 3292)
service.exe (PID: 5560)
cmd.exe (PID: 2784)
conhost.exe (PID: 4420)
cmd.exe (PID: 4632)

Starts CMD.EXE for commands execution

64.exe (PID: 2428)
service.exe (PID: 1452)
cmd.exe (PID: 3848)
service.exe (PID: 4036)
service.exe (PID: 676)
cmd.exe (PID: 3292)
service.exe (PID: 5560)
cmd.exe (PID: 2784)
conhost.exe (PID: 4420)
cmd.exe (PID: 4632)

Modifies files in Chrome extension folder

chrome.exe (PID: 1876)

Executable content was dropped or overwritten

chrome.exe (PID: 3876)
chrome.exe (PID: 1876)
service.exe (PID: 5560)
conhost.exe (PID: 4420)

Uses ATTRIB.EXE to modify file attributes

cmd.exe (PID: 772)
cmd.exe (PID: 2548)
cmd.exe (PID: 3848)
cmd.exe (PID: 3148)
cmd.exe (PID: 3292)
cmd.exe (PID: 4364)
cmd.exe (PID: 2784)
cmd.exe (PID: 5912)
cmd.exe (PID: 1008)
cmd.exe (PID: 5348)
cmd.exe (PID: 4392)
cmd.exe (PID: 4764)
cmd.exe (PID: 4732)
cmd.exe (PID: 4668)
cmd.exe (PID: 4728)
cmd.exe (PID: 4664)
cmd.exe (PID: 5044)
cmd.exe (PID: 3024)
cmd.exe (PID: 5320)
cmd.exe (PID: 5960)
cmd.exe (PID: 4612)
cmd.exe (PID: 5808)
cmd.exe (PID: 4496)
cmd.exe (PID: 4116)
cmd.exe (PID: 4380)
cmd.exe (PID: 5332)
cmd.exe (PID: 5672)
cmd.exe (PID: 2216)
cmd.exe (PID: 2400)
cmd.exe (PID: 4272)
cmd.exe (PID: 4472)
cmd.exe (PID: 5432)
cmd.exe (PID: 6132)
cmd.exe (PID: 4892)
cmd.exe (PID: 4604)
cmd.exe (PID: 5072)
cmd.exe (PID: 4624)
cmd.exe (PID: 3368)
cmd.exe (PID: 1388)
cmd.exe (PID: 3304)
cmd.exe (PID: 3652)
cmd.exe (PID: 4936)
cmd.exe (PID: 5696)
cmd.exe (PID: 5196)
cmd.exe (PID: 4748)
cmd.exe (PID: 4232)
cmd.exe (PID: 4736)
cmd.exe (PID: 4408)
cmd.exe (PID: 3228)
cmd.exe (PID: 5312)
cmd.exe (PID: 5232)
cmd.exe (PID: 3112)
cmd.exe (PID: 5532)
cmd.exe (PID: 2800)
cmd.exe (PID: 4944)
cmd.exe (PID: 5380)
cmd.exe (PID: 5964)
cmd.exe (PID: 2708)
cmd.exe (PID: 5212)
cmd.exe (PID: 3644)
cmd.exe (PID: 6084)
cmd.exe (PID: 3604)
cmd.exe (PID: 5792)
cmd.exe (PID: 5884)
cmd.exe (PID: 6024)
cmd.exe (PID: 5916)
cmd.exe (PID: 5252)
cmd.exe (PID: 4632)
cmd.exe (PID: 1648)
cmd.exe (PID: 5916)
cmd.exe (PID: 1848)
cmd.exe (PID: 1872)
cmd.exe (PID: 924)
cmd.exe (PID: 4412)
cmd.exe (PID: 4280)
cmd.exe (PID: 4572)
cmd.exe (PID: 4200)
cmd.exe (PID: 2552)
cmd.exe (PID: 5524)
cmd.exe (PID: 4824)
cmd.exe (PID: 3184)
cmd.exe (PID: 2772)
cmd.exe (PID: 4132)
cmd.exe (PID: 5148)
cmd.exe (PID: 6076)
cmd.exe (PID: 3828)
cmd.exe (PID: 1704)
cmd.exe (PID: 3096)

Creates files in the Windows directory

service.exe (PID: 1452)
service.exe (PID: 4036)
service.exe (PID: 5560)
conhost.exe (PID: 4420)
cmd.exe (PID: 4632)

Executes scripts

service.exe (PID: 1452)
service.exe (PID: 4036)
service.exe (PID: 5560)
service.exe (PID: 676)

Application launched itself

cmd.exe (PID: 3848)
cmd.exe (PID: 3292)
cmd.exe (PID: 2784)
cmd.exe (PID: 4632)

Uses NETSH.EXE for network configuration

cmd.exe (PID: 3848)
cmd.exe (PID: 2784)
cmd.exe (PID: 3292)
cmd.exe (PID: 4632)

Uses IPCONFIG.EXE to discover IP address

cmd.exe (PID: 3848)
cmd.exe (PID: 3292)
cmd.exe (PID: 4632)

Removes files from Windows directory

cmd.exe (PID: 3848)
cmd.exe (PID: 3292)
cmd.exe (PID: 4632)

Uses TASKKILL.EXE to kill process

cmd.exe (PID: 3848)
cmd.exe (PID: 2784)
cmd.exe (PID: 3292)
cmd.exe (PID: 4632)
conhost.exe (PID: 4420)
cmd.exe (PID: 5764)
cmd.exe (PID: 5572)
cmd.exe (PID: 5968)
cmd.exe (PID: 5612)

Creates executable files which already exist in Windows

service.exe (PID: 5560)

Executed as Windows Service

svchost.exe (PID: 5184)
svchost.exe (PID: 4700)

Creates files in the driver directory

cmd.exe (PID: 4632)

Creates or modifies windows services

netsh.exe (PID: 4780)

INFO

Manual execution by user

chrome.exe (PID: 1876)
taskmgr.exe (PID: 3676)
service.exe (PID: 5560)

Reads the hosts file

chrome.exe (PID: 3876)
chrome.exe (PID: 1876)

Reads Internet Cache Settings

chrome.exe (PID: 1876)

Application launched itself

chrome.exe (PID: 1876)

Threats

PID	Process	Class	Message
3876	chrome.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3876	chrome.exe	A Network Trojan was detected	ET CURRENT_EVENTS DRIVEBY Likely Evil EXE with no referer from HFS webserver (used by Unknown EK)
3876	chrome.exe	Misc activity	ET INFO EXE - Served Attached HTTP
5116	d1lhots.exe	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin
5116	d1lhots.exe	Misc activity	MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
5116	d1lhots.exe	Misc activity	MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
5116	d1lhots.exe	Misc activity	MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
5116	d1lhots.exe	Misc activity	MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login
5116	d1lhots.exe	Misc activity	MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response
—	—	Potential Corporate Privacy Violation	ET POLICY Cryptocurrency Miner Checkin

Rows per page