Overview

overview

10

Static

static

1

e60c79a783...97.exe

windows7_x64

10

e60c79a783...97.exe

windows10_x64

10

Resubmissions

03/09/2026, 13:03

260903-qapyqstwbw7

24/01/2022, 02:45

220124-c871baafdm10

Analysis

  • max time kernel
    152s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24/01/2022, 02:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe
  • Size 1.8MB
  • Sample220124-c871baafdm
  • SHA256 e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97
  • MD5 SHA1 SHA512
Score
10/10
xmrigminerupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Executes dropped EXE 6 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 22 IoCs
  • Drops file in System32 directory 11 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 14 IoCs
    installer
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe
      "C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\Users\Admin\AppData\Local\Temp\dccntnfxwn.exe
        "C:\Users\Admin\AppData\Local\Temp\dccntnfxwn.exe" "C:\Users\Admin\AppData\Local\Temp\tylklrudqe.exe" "C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:584
        • C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe
          "C:\Users\Admin\AppData\Local\Temp\e60c79a783d44f065df7fd238949c7ee86bdb11c82ed929e72fc470e4c7dae97.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: GetForegroundWindowSpam
          PID:452
      • C:\Users\Admin\AppData\Local\Temp\bmzjjsjsjd.exe
        C:\Users\Admin\AppData\Local\Temp\bmzjjsjsjd.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:560
        • C:\Windows\System32\Identities\bindsvc.exe
          "C:\Windows\System32\Identities\bindsvc.exe"
          4⤵
          • Executes dropped EXE
          PID:304
        • C:\Windows\System32\cmd.exe
          /c sc config msdtc obj= LocalSystem
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1048
          • C:\Windows\system32\sc.exe
            sc config msdtc obj= LocalSystem
            5⤵
              PID:1424
          • C:\Windows\system32\cmd.exe
            cmd /c "C:\Users\Admin\AppData\Local\Temp\rWWFsTwf.bat"
            4⤵
              PID:1588
      • C:\Windows\System32\smss.exe
        \SystemRoot\System32\smss.exe
        1⤵
          PID:260
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Windows\system32\SearchUserHost.exe
            C:\Windows\system32\SearchUserHost.exe
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1948
            • C:\Windows\system32\cmd.exe
              /c systeminfo
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1836
              • C:\Windows\system32\systeminfo.exe
                systeminfo
                4⤵
                • Gathers system information
                PID:756
            • C:\Windows\system32\cmd.exe
              /c "tasklist /v"
              3⤵
                PID:1064
                • C:\Windows\system32\tasklist.exe
                  tasklist /v
                  4⤵
                  • Enumerates processes with tasklist
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:552
              • C:\Windows\system32\cmd.exe
                /c "netstat -ano"
                3⤵
                  PID:288
                  • C:\Windows\system32\NETSTAT.EXE
                    netstat -ano
                    4⤵
                    • Gathers network information
                    • Suspicious use of AdjustPrivilegeToken
                    PID:832
                • C:\Windows\system32\cmd.exe
                  /c "ipconfig /all"
                  3⤵
                    PID:1608
                    • C:\Windows\system32\ipconfig.exe
                      ipconfig /all
                      4⤵
                      • Gathers network information
                      PID:1584
                  • C:\Windows\system32\cmd.exe
                    /c "route print"
                    3⤵
                      PID:776
                      • C:\Windows\system32\ROUTE.EXE
                        route print
                        4⤵
                          PID:632
                      • C:\Windows\system32\cmd.exe
                        /c "arp -a"
                        3⤵
                          PID:1640
                          • C:\Windows\system32\ARP.EXE
                            arp -a
                            4⤵
                              PID:1280
                          • C:\Windows\system32\cmd.exe
                            /c "tasklist /m msfte.dll"
                            3⤵
                              PID:304
                              • C:\Windows\system32\tasklist.exe
                                tasklist /m msfte.dll
                                4⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1300
                            • C:\Windows\system32\cmd.exe
                              /c "net share"
                              3⤵
                                PID:1916
                                • C:\Windows\system32\net.exe
                                  net share
                                  4⤵
                                    PID:1648
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 share
                                      5⤵
                                        PID:1760
                                  • C:\Windows\system32\cmd.exe
                                    /c "ping server"
                                    3⤵
                                      PID:1316
                                      • C:\Windows\system32\PING.EXE
                                        ping server
                                        4⤵
                                        • Runs ping.exe
                                        PID:1348
                                    • C:\Windows\system32\cmd.exe
                                      /c "sc query hfile.sys"
                                      3⤵
                                        PID:1100
                                        • C:\Windows\system32\sc.exe
                                          sc query hfile.sys
                                          4⤵
                                            PID:1196
                                      • C:\Windows\system32\SearchProtocolHost.exe
                                        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3846991908-3261386348-1409841751-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3846991908-3261386348-1409841751-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                        2⤵
                                        • Loads dropped DLL
                                        • Suspicious use of SetWindowsHookEx
                                        PID:704
                                      • C:\Windows\system32\SearchFilterHost.exe
                                        "C:\Windows\system32\SearchFilterHost.exe" 0 536 560 564 65536 556
                                        2⤵
                                        • Modifies data under HKEY_USERS
                                        PID:984
                                      • C:\Windows\system32\SearchProtocolHost.exe
                                        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                        2⤵
                                        • Loads dropped DLL
                                        • Drops file in System32 directory
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of SetWindowsHookEx
                                        PID:976

                                    Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          memory/976-147-0x000007FEFC451000-0x000007FEFC453000-memory.dmp
                                          Download

                                          memory/976-54-0x0000000076491000-0x0000000076493000-memory.dmp
                                          Download

                                          memory/984-157-0x000007FEF2F80000-0x000007FEF30C3000-memory.dmp
                                          Download

                                          memory/984-158-0x000007FE79BD0000-0x000007FE79BDA000-memory.dmp
                                          Download

                                          memory/1088-129-0x0000000001070000-0x0000000001071000-memory.dmp
                                          Download

                                          memory/1412-89-0x0000000002720000-0x0000000002721000-memory.dmp
                                          Download