xmrig | ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43

General

Target

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
Size

430KB
MD5

ab8f50a8ce75108e39e110f206b9d281
SHA1

e523bf8ab764f9072cef29528e626bfa19bec808
SHA256

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43
SHA512

8d5fcc88f7811cedfb2ab00fc86288a7642c8cdf72b057b2a134a78ebccce078cb8858ae377cea2d26d751133b41c19277a0fe7a443e16cc1069156a5ab1956a

Score

10^/10

xmrig miner persistence spyware stealer

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Drops startup file 2 IoCs

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qzXLZMqs.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qzXLZMqs.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\windows\currentversion\run	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NAVAP = "C:\\Windows\\03FdhsLZkmvQ.exe"	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
File opened (read-only)	\??\e:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\f:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\l:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\t:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\x:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\r:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\s:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\q:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\v:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\g:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\h:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\i:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\j:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\k:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\m:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\w:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\n:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\o:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\p:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\u:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\y:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened (read-only)	\??\z:	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Drops file in System32 directory 4 IoCs

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
File created	\??\c:\Windows\SysWOW64\shutdown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Windows\SysWOW64\shutdown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File created	\??\c:\Windows\SysWOW64\takeown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Windows\SysWOW64\takeown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Drops file in Program Files directory 2 IoCs

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Drops file in Windows directory 10 IoCs

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

description	ioc	process
File created	C:\Windows\03FdhsLZkmvQ.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_58116b392c3da43c\takeown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_02aa6dd4294b8d5f\shutdown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File created	\??\c:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_fbf2cfb573e03306\takeown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	C:\Windows\03FdhsLZkmvQ.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
File created	\??\c:\Windows\winsxs\amd64_microsoft-windows-takeown_31bf3856ad364e35_6.1.7601.17514_none_58116b392c3da43c\takeown.exe	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

pid	process
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
1048	ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe

C:\Users\Admin\AppData\Local\Temp\ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe
"C:\Users\Admin\AppData\Local\Temp\ddb5186ef00a92423f635bd5e267f452cb4785a0454e09a60677cf03a05a9a43.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1048