592ea2c548c74f9778a17ac78eba08eb7bfde214d690a7e593731fdbd604c877

Analysis

max time kernel
151s
max time network
116s
platform
windows10_x64
resource
win10v20210410
submitted
10-08-2021 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cheat.exe
Size

12.2MB
MD5

69c885675b1b98e2fbb3f0196a1df2d1
SHA1

533fa79f3b20623ae1c6de3fded5fb54b145af6a
SHA256

73bcd67ddecc7bf320a19bd5dbefdb36c097c3047959d67e0e3cc5e22f8b510b
SHA512

8b89b0a456e9d423c7e0d053772716f2e0e7877bff250e08f788d20b20fcb00bb6da831f59a781964ede23f9de74b5afcda0183d104fca523b392a89d063e44c

Score

9^/10

miner vmprotect

Malware Config

Signatures

Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner

Executes dropped EXE 31 IoCs

pid	Process
3704	d.exe
2104	Start.exe
1116	Defender.exe
680	Defender.exe
196	Defender.exe
4000	Defender.exe
2072	Defender.exe
2292	Defender.exe
1128	Defender.exe
2824	Defender.exe
3340	Defender.exe
3280	Defender.exe
2884	Defender.exe
2368	Defender.exe
3276	Defender.exe
3928	Defender.exe
3584	Defender.exe
3864	Defender.exe
2680	Defender.exe
2848	Defender.exe
2240	Defender.exe
4000	Defender.exe
1276	Defender.exe
3604	Defender.exe
2816	Defender.exe
2828	Defender.exe
2192	Defender.exe
496	Defender.exe
580	Defender.exe
184	Defender.exe
2192	Defender.exe

VMProtect packed file 59 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral10/files/0x000100000001ab5e-168.dat	vmprotect
behavioral10/files/0x000100000001ab5e-170.dat	vmprotect
behavioral10/memory/1116-171-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-181.dat	vmprotect
behavioral10/memory/680-182-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-191.dat	vmprotect
behavioral10/memory/196-192-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-201.dat	vmprotect
behavioral10/memory/4000-202-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-211.dat	vmprotect
behavioral10/memory/2072-212-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-221.dat	vmprotect
behavioral10/memory/2292-222-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-231.dat	vmprotect
behavioral10/memory/1128-232-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-241.dat	vmprotect
behavioral10/memory/2824-242-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-251.dat	vmprotect
behavioral10/memory/3340-252-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-261.dat	vmprotect
behavioral10/memory/3280-262-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-271.dat	vmprotect
behavioral10/memory/2884-272-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-281.dat	vmprotect
behavioral10/memory/2368-282-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-291.dat	vmprotect
behavioral10/memory/3276-292-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-301.dat	vmprotect
behavioral10/memory/3928-302-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-311.dat	vmprotect
behavioral10/memory/3584-312-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-321.dat	vmprotect
behavioral10/memory/3864-322-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-331.dat	vmprotect
behavioral10/memory/2680-332-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-341.dat	vmprotect
behavioral10/memory/2848-342-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-351.dat	vmprotect
behavioral10/memory/2240-352-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-361.dat	vmprotect
behavioral10/memory/4000-362-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-371.dat	vmprotect
behavioral10/memory/1276-372-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-381.dat	vmprotect
behavioral10/memory/3604-382-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-391.dat	vmprotect
behavioral10/memory/2816-392-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-401.dat	vmprotect
behavioral10/memory/2828-402-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-411.dat	vmprotect
behavioral10/memory/2192-412-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-421.dat	vmprotect
behavioral10/memory/496-422-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-431.dat	vmprotect
behavioral10/memory/580-432-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-439.dat	vmprotect
behavioral10/memory/184-440-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral10/files/0x000100000001ab5e-447.dat	vmprotect
behavioral10/memory/2192-448-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs

pid	Process
1116	Defender.exe
680	Defender.exe
196	Defender.exe
4000	Defender.exe
2072	Defender.exe
2292	Defender.exe
1128	Defender.exe
2824	Defender.exe
3340	Defender.exe
3280	Defender.exe
2884	Defender.exe
2368	Defender.exe
3276	Defender.exe
3928	Defender.exe
3584	Defender.exe
3864	Defender.exe
2680	Defender.exe
2848	Defender.exe
2240	Defender.exe
4000	Defender.exe
1276	Defender.exe
3604	Defender.exe
2816	Defender.exe
2828	Defender.exe
2192	Defender.exe
496	Defender.exe
580	Defender.exe
184	Defender.exe
2192	Defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3340	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
752	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cheat.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
204	powershell.exe
204	powershell.exe
204	powershell.exe
204	powershell.exe
204	powershell.exe
1116	Defender.exe
1116	Defender.exe
204	powershell.exe
204	powershell.exe
204	powershell.exe
680	Defender.exe
680	Defender.exe
204	powershell.exe
204	powershell.exe
196	Defender.exe
196	Defender.exe
204	powershell.exe
204	powershell.exe
4000	Defender.exe
4000	Defender.exe
204	powershell.exe
204	powershell.exe
2072	Defender.exe
2072	Defender.exe
204	powershell.exe
204	powershell.exe
2292	Defender.exe
2292	Defender.exe
204	powershell.exe
204	powershell.exe
204	powershell.exe
1128	Defender.exe
1128	Defender.exe
204	powershell.exe
204	powershell.exe
2824	Defender.exe
2824	Defender.exe
204	powershell.exe
204	powershell.exe
3340	Defender.exe
3340	Defender.exe
204	powershell.exe
204	powershell.exe
204	powershell.exe
3280	Defender.exe
3280	Defender.exe
204	powershell.exe
204	powershell.exe
2884	Defender.exe
2884	Defender.exe
204	powershell.exe
204	powershell.exe
2368	Defender.exe
2368	Defender.exe
204	powershell.exe
204	powershell.exe
3276	Defender.exe
3276	Defender.exe
204	powershell.exe
204	powershell.exe
3928	Defender.exe
3928	Defender.exe
204	powershell.exe
204	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	204	powershell.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1116	Defender.exe
1116	Defender.exe
1116	Defender.exe
1116	Defender.exe
1116	Defender.exe
680	Defender.exe
680	Defender.exe
680	Defender.exe
680	Defender.exe
680	Defender.exe
196	Defender.exe
196	Defender.exe
196	Defender.exe
196	Defender.exe
196	Defender.exe
4000	Defender.exe
4000	Defender.exe
4000	Defender.exe
4000	Defender.exe
4000	Defender.exe
2072	Defender.exe
2072	Defender.exe
2072	Defender.exe
2072	Defender.exe
2072	Defender.exe
2292	Defender.exe
2292	Defender.exe
2292	Defender.exe
2292	Defender.exe
2292	Defender.exe
1128	Defender.exe
1128	Defender.exe
1128	Defender.exe
1128	Defender.exe
1128	Defender.exe
2824	Defender.exe
2824	Defender.exe
2824	Defender.exe
2824	Defender.exe
2824	Defender.exe
3340	Defender.exe
3340	Defender.exe
3340	Defender.exe
3340	Defender.exe
3340	Defender.exe
3280	Defender.exe
3280	Defender.exe
3280	Defender.exe
3280	Defender.exe
3280	Defender.exe
2884	Defender.exe
2884	Defender.exe
2884	Defender.exe
2884	Defender.exe
2884	Defender.exe
2368	Defender.exe
2368	Defender.exe
2368	Defender.exe
2368	Defender.exe
2368	Defender.exe
3276	Defender.exe
3276	Defender.exe
3276	Defender.exe
3276	Defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3700	4032	cheat.exe	76
PID 4032 wrote to memory of 3700	4032	cheat.exe	76
PID 3700 wrote to memory of 3704	3700	WScript.exe	77
PID 3700 wrote to memory of 3704	3700	WScript.exe	77
PID 3700 wrote to memory of 1896	3700	WScript.exe	78
PID 3700 wrote to memory of 1896	3700	WScript.exe	78
PID 1896 wrote to memory of 3340	1896	cmd.exe	80
PID 1896 wrote to memory of 3340	1896	cmd.exe	80
PID 4032 wrote to memory of 2104	4032	cheat.exe	83
PID 4032 wrote to memory of 2104	4032	cheat.exe	83
PID 2104 wrote to memory of 3900	2104	Start.exe	84
PID 2104 wrote to memory of 3900	2104	Start.exe	84
PID 3900 wrote to memory of 752	3900	cmd.exe	86
PID 3900 wrote to memory of 752	3900	cmd.exe	86
PID 3900 wrote to memory of 204	3900	cmd.exe	88
PID 3900 wrote to memory of 204	3900	cmd.exe	88
PID 204 wrote to memory of 1384	204	powershell.exe	89
PID 204 wrote to memory of 1384	204	powershell.exe	89
PID 1384 wrote to memory of 3032	1384	csc.exe	90
PID 1384 wrote to memory of 3032	1384	csc.exe	90
PID 204 wrote to memory of 3788	204	powershell.exe	91
PID 204 wrote to memory of 3788	204	powershell.exe	91
PID 3788 wrote to memory of 1116	3788	WScript.exe	92
PID 3788 wrote to memory of 1116	3788	WScript.exe	92
PID 204 wrote to memory of 3868	204	powershell.exe	94
PID 204 wrote to memory of 3868	204	powershell.exe	94
PID 3868 wrote to memory of 680	3868	WScript.exe	95
PID 3868 wrote to memory of 680	3868	WScript.exe	95
PID 204 wrote to memory of 3708	204	powershell.exe	97
PID 204 wrote to memory of 3708	204	powershell.exe	97
PID 3708 wrote to memory of 196	3708	WScript.exe	98
PID 3708 wrote to memory of 196	3708	WScript.exe	98
PID 204 wrote to memory of 2284	204	powershell.exe	100
PID 204 wrote to memory of 2284	204	powershell.exe	100
PID 2284 wrote to memory of 4000	2284	WScript.exe	101
PID 2284 wrote to memory of 4000	2284	WScript.exe	101
PID 204 wrote to memory of 1028	204	powershell.exe	103
PID 204 wrote to memory of 1028	204	powershell.exe	103
PID 1028 wrote to memory of 2072	1028	WScript.exe	104
PID 1028 wrote to memory of 2072	1028	WScript.exe	104
PID 204 wrote to memory of 1372	204	powershell.exe	106
PID 204 wrote to memory of 1372	204	powershell.exe	106
PID 1372 wrote to memory of 2292	1372	WScript.exe	107
PID 1372 wrote to memory of 2292	1372	WScript.exe	107
PID 204 wrote to memory of 3128	204	powershell.exe	109
PID 204 wrote to memory of 3128	204	powershell.exe	109
PID 3128 wrote to memory of 1128	3128	WScript.exe	110
PID 3128 wrote to memory of 1128	3128	WScript.exe	110
PID 204 wrote to memory of 3604	204	powershell.exe	112
PID 204 wrote to memory of 3604	204	powershell.exe	112
PID 3604 wrote to memory of 2824	3604	WScript.exe	113
PID 3604 wrote to memory of 2824	3604	WScript.exe	113
PID 204 wrote to memory of 2528	204	powershell.exe	115
PID 204 wrote to memory of 2528	204	powershell.exe	115
PID 2528 wrote to memory of 3340	2528	WScript.exe	116
PID 2528 wrote to memory of 3340	2528	WScript.exe	116
PID 204 wrote to memory of 840	204	powershell.exe	118
PID 204 wrote to memory of 840	204	powershell.exe	118
PID 840 wrote to memory of 3280	840	WScript.exe	119
PID 840 wrote to memory of 3280	840	WScript.exe	119
PID 204 wrote to memory of 3036	204	powershell.exe	121
PID 204 wrote to memory of 3036	204	powershell.exe	121
PID 3036 wrote to memory of 2884	3036	WScript.exe	122
PID 3036 wrote to memory of 2884	3036	WScript.exe	122

C:\Users\Admin\AppData\Local\Temp\cheat.exe
"C:\Users\Admin\AppData\Local\Temp\cheat.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\d.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\ProgramData\Windows\d.exe
    "C:\ProgramData\Windows\d.exe" 61 C:\ProgramData\Windows\d.bat
    3⤵
    - Executes dropped EXE
    PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Windows\t.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /CREATE /SC ONLOGON /TN "Windows Defender" /TR "C:\ProgramData\Windows\Start.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:3340
- C:\ProgramData\Windows\Start.exe
  C:\ProgramData\Windows\Start.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\304D.tmp\305D.tmp\305E.bat C:\ProgramData\Windows\Start.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\Windows\system32\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -executionpolicy Unrestricted C:\ProgramData\Windows\timeout.ps1
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ymdnpxx3\ymdnpxx3.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1384
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C10.tmp" "c:\Users\Admin\AppData\Local\Temp\ymdnpxx3\CSCA01756A6D1B482A871A44B1537A164A.TMP"
        6⤵
        
        PID:3032
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3788
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1116
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:680
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:196
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4000
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2072
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1372
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2292
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3128
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1128
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3604
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2824
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2528
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3340
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3280
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3036
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3184
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2368
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:1772
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3276
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:748
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3928
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:496
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3584
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2124
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3864
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2260
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2680
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:536
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2848
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:752
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2240
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3704
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4000
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2536
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1276
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2288
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3604
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2172
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2816
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:4000
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2828
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:1276
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2192
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:1888
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:496
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:744
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:580
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3340
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:184
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2380
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/184-440-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/196-192-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/204-155-0x0000025A76A80000-0x0000025A76A81000-memory.dmp

Filesize
4KB

Download
memory/204-136-0x0000025A76970000-0x0000025A76972000-memory.dmp

Filesize
8KB

Download
memory/204-138-0x0000025A76973000-0x0000025A76975000-memory.dmp

Filesize
8KB

Download
memory/204-137-0x0000025A77570000-0x0000025A77571000-memory.dmp

Filesize
4KB

Download
memory/204-133-0x0000025A76A50000-0x0000025A76A51000-memory.dmp

Filesize
4KB

Download
memory/496-422-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/580-432-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/680-182-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1116-172-0x00007FFD758E0000-0x00007FFD758E2000-memory.dmp

Filesize
8KB

Download
memory/1116-171-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1128-232-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1276-372-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2072-212-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2192-448-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2192-412-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2240-352-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2292-222-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2368-282-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2680-332-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2816-392-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2824-242-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2828-402-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2848-342-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2884-272-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3276-292-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3280-262-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3340-252-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3584-312-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3604-382-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3864-322-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3928-302-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/4000-202-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/4000-362-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download