a98ccb74c29d4e6c3929cfea2f157dd53ce9c3ea67bd25934aab24f416ce9d13

General

Target

xmr.exe
Size

1.8MB
MD5

b1e29e528a7510be3c04dcff622f63ab
SHA1

ae8a2d88a4b0bcd8a11364be5a687f2a2a86d83a
SHA256

a98ccb74c29d4e6c3929cfea2f157dd53ce9c3ea67bd25934aab24f416ce9d13
SHA512

e7f59ab406d79832dacd0c4bdeb4bbbe8cc626bcf247502f8a817d2f2e39449450806976f5cb725a35f1bb1a58ef41488b32d6aea9cf3a54590c7989d3696040

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2408-114-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral2/memory/2408-115-0x0000000000400000-0x0000000000A16000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gCJCBpvUDZ.url wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gCJCBpvUDZ.url	wscript.exe

Suspicious use of SetThreadContext 15 IoCs

Processes:

xmr.exe

description	pid	process	target process
PID 512 set thread context of 2408	512	xmr.exe	notepad.exe
PID 512 set thread context of 2348	512	xmr.exe	notepad.exe
PID 512 set thread context of 188	512	xmr.exe	notepad.exe
PID 512 set thread context of 1504	512	xmr.exe	notepad.exe
PID 512 set thread context of 1704	512	xmr.exe	notepad.exe
PID 512 set thread context of 2760	512	xmr.exe	notepad.exe
PID 512 set thread context of 2260	512	xmr.exe	notepad.exe
PID 512 set thread context of 3400	512	xmr.exe	notepad.exe
PID 512 set thread context of 208	512	xmr.exe	notepad.exe
PID 512 set thread context of 2528	512	xmr.exe	notepad.exe
PID 512 set thread context of 2408	512	xmr.exe	notepad.exe
PID 512 set thread context of 3284	512	xmr.exe	notepad.exe
PID 512 set thread context of 1704	512	xmr.exe	notepad.exe
PID 512 set thread context of 3880	512	xmr.exe	notepad.exe
PID 512 set thread context of 680	512	xmr.exe	notepad.exe

Program crash 15 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1268	2408	WerFault.exe	notepad.exe
2260	2348	WerFault.exe	notepad.exe
808	188	WerFault.exe	notepad.exe
1000	1504	WerFault.exe	notepad.exe
3344	1704	WerFault.exe	notepad.exe
2716	2760	WerFault.exe	notepad.exe
3700	2260	WerFault.exe	notepad.exe
2252	3400	WerFault.exe	notepad.exe
3692	208	WerFault.exe	notepad.exe
1044	2528	WerFault.exe	notepad.exe
2708	2408	WerFault.exe	notepad.exe
1204	3284	WerFault.exe	notepad.exe
2932	1704	WerFault.exe	notepad.exe
640	3880	WerFault.exe	notepad.exe
3304	680	WerFault.exe	notepad.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

xmr.exe

pid	process
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe
512	xmr.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

xmr.exe

description	pid	process
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe
Token: SeDebugPrivilege	512	xmr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

xmr.execmd.exe

description	pid	process	target process
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2408	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	cmd.exe
PID 512 wrote to memory of 2760	512	xmr.exe	cmd.exe
PID 512 wrote to memory of 2760	512	xmr.exe	cmd.exe
PID 2760 wrote to memory of 3512	2760	cmd.exe	wscript.exe
PID 2760 wrote to memory of 3512	2760	cmd.exe	wscript.exe
PID 2760 wrote to memory of 3512	2760	cmd.exe	wscript.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2348	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 188	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1504	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 1704	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2760	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 2260	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 3400	512	xmr.exe	notepad.exe
PID 512 wrote to memory of 3400	512	xmr.exe	notepad.exe

C:\Users\Admin\AppData\Local\Temp\xmr.exe
"C:\Users\Admin\AppData\Local\Temp\xmr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:2408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2408 -s 116
3⤵
- Program crash
PID:1268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C WScript "C:\ProgramData\CjtqpVHEcA\r.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\wscript.exe
WScript "C:\ProgramData\CjtqpVHEcA\r.vbs"
3⤵
- Drops startup file
PID:3512

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:2348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2348 -s 180
3⤵
- Program crash
PID:2260

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:188

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 188 -s 180
3⤵
- Program crash
PID:808

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:1504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1504 -s 180
3⤵
- Program crash
PID:1000

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:1704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1704 -s 188
3⤵
- Program crash
PID:3344

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:2760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2760 -s 180
3⤵
- Program crash
PID:2716

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:2260

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2260 -s 180
3⤵
- Program crash
PID:3700

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:3400

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3400 -s 180
3⤵
- Program crash
PID:2252

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:208

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 208 -s 180
3⤵
- Program crash
PID:3692

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:2528

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2528 -s 180
3⤵
- Program crash
PID:1044

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:2408

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2408 -s 200
3⤵
- Program crash
PID:2708

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:3284

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3284 -s 180
3⤵
- Program crash
PID:1204

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:1704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1704 -s 188
3⤵
- Program crash
PID:2932

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:3880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3880 -s 180
3⤵
- Program crash
PID:640

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\ProgramData\CjtqpVHEcA\cfgi"
2⤵
PID:680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 680 -s 180
3⤵
- Program crash
PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\CjtqpVHEcA\r.vbs
MD5
0065ee24d4dd8d3de7357eca05dd7605

SHA1
8ec12f52f6c59a894c0d7aa829be62f0a9423a92

SHA256
5b5f9317f61c56cf5f568327c0220b23287f7043b071e93e1f3a2d3f31cacda3

SHA512
71966d11180ee59316922b576d6c1d5ec80694d899f861d83e28012418fedf57b0a3a53d5de2e3f52dde1cf376fc57efbe4b8ef1a182d5a798c02ac291265bb6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gCJCBpvUDZ.url
MD5
0d14a943975c648c95879341d15993c5

SHA1
f3b9af3e748daee22572d5b9d94e5b25795acb04

SHA256
9a0efbbe99d58279d8df483820fc8d0990719164254def0109564540cad9dc58

SHA512
f898b8421ecf615d501c883ffb395da9d3512d6918100b8a1061121b6540d7d6cfae96b07b80eeba4bba0c940c567f0630031609917ec86904420045de9f2c9f

Download Submit
memory/188-130-0x0000000000A14AA0-mapping.dmp

Download
memory/208-160-0x0000000000A14AA0-mapping.dmp

Download
memory/680-190-0x0000000000A14AA0-mapping.dmp

Download
memory/1504-135-0x0000000000A14AA0-mapping.dmp

Download
memory/1704-140-0x0000000000A14AA0-mapping.dmp

Download
memory/1704-180-0x0000000000A14AA0-mapping.dmp

Download
memory/2260-150-0x0000000000A14AA0-mapping.dmp

Download
memory/2348-125-0x0000000000A14AA0-mapping.dmp

Download
memory/2408-168-0x0000000000400000-0x0000000000400138-memory.dmp

Filesize
312B

Download
memory/2408-114-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2408-116-0x0000000000A14AA0-mapping.dmp

Download
memory/2408-170-0x0000000000A14AA0-mapping.dmp

Download
memory/2408-115-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2528-165-0x0000000000A14AA0-mapping.dmp

Download
memory/2760-145-0x0000000000A14AA0-mapping.dmp

Download
memory/2760-119-0x0000000000000000-mapping.dmp

Download
memory/3284-175-0x0000000000A14AA0-mapping.dmp

Download
memory/3400-155-0x0000000000A14AA0-mapping.dmp

Download
memory/3512-120-0x0000000000000000-mapping.dmp

Download
memory/3880-185-0x0000000000A14AA0-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads