Analysis
- max time kernel
148s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
14/11/2022, 00:14
General
- Target file.exe
- Size 1.5MB
- Sample221114-ajbvgadh44
- SHA256 def06fcab9ce095e4952f80d7a9acc2808bf342606e23e5b8a188b9e62251d53
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 7 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp19A9.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\WindowsMail\AVPTQBAEW.exe"C:\ProgramData\WindowsMail\AVPTQBAEW.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
AVPTQBAEW.exe
AVPTQBAEW.exe
tmp19A9.tmp.bat
590aee7bdd69b59b.customDestinations-ms
AVPTQBAEW.exe
memory/1572-120-0x000007FEEBEB0000-0x000007FEECA0D000-memory.dmp
memory/1572-121-0x000000001B6F0000-0x000000001B9EF000-memory.dmp
memory/1572-122-0x00000000028D4000-0x00000000028D7000-memory.dmp
memory/1572-123-0x00000000028DB000-0x00000000028FA000-memory.dmp
memory/1572-124-0x00000000028DB000-0x00000000028FA000-memory.dmp
memory/1616-100-0x000007FEFD2C0000-0x000007FEFD331000-memory.dmp
memory/1616-130-0x000007FEF0C90000-0x000007FEF0CF2000-memory.dmp
memory/1616-148-0x00000000009A0000-0x0000000000B84000-memory.dmp
memory/1616-137-0x000007FEFC370000-0x000007FEFC3CB000-memory.dmp
memory/1616-136-0x000007FEFCF40000-0x000007FEFCF76000-memory.dmp
memory/1616-135-0x000007FEFA920000-0x000007FEFA947000-memory.dmp
memory/1616-134-0x000007FEFCB20000-0x000007FEFCB45000-memory.dmp
memory/1616-133-0x000007FEF9F50000-0x000007FEF9FC1000-memory.dmp
memory/1616-132-0x000007FEF9EE0000-0x000007FEF9F44000-memory.dmp
memory/1616-131-0x000007FEFF1D0000-0x000007FEFF21D000-memory.dmp
memory/1616-129-0x000007FEF0C70000-0x000007FEF0C8C000-memory.dmp
memory/1616-128-0x000007FEFC550000-0x000007FEFC567000-memory.dmp
memory/1616-127-0x000007FEFC6A0000-0x000007FEFC6C2000-memory.dmp
memory/1616-126-0x000007FEFD2A0000-0x000007FEFD2BF000-memory.dmp
memory/1616-125-0x000007FEFD8C0000-0x000007FEFD997000-memory.dmp
memory/1616-119-0x000007FEFB330000-0x000007FEFB545000-memory.dmp
memory/1616-111-0x000007FEF64C0000-0x000007FEF65EC000-memory.dmp
memory/1616-110-0x00000000009A0000-0x0000000000B84000-memory.dmp
memory/1616-108-0x0000000000710000-0x0000000000751000-memory.dmp
memory/1616-109-0x00000000009A0000-0x0000000000B84000-memory.dmp
memory/1616-107-0x00000000009A0000-0x0000000000B84000-memory.dmp
memory/1616-106-0x000007FEFB580000-0x000007FEFB5D6000-memory.dmp
memory/1616-105-0x000007FEFD3A0000-0x000007FEFD5A3000-memory.dmp
memory/1616-94-0x000007FEFA5A0000-0x000007FEFA63C000-memory.dmp
memory/1616-95-0x000007FEFD200000-0x000007FEFD267000-memory.dmp
memory/1616-96-0x0000000076E10000-0x0000000076F0A000-memory.dmp
memory/1616-93-0x000007FEFA8B0000-0x000007FEFA91F000-memory.dmp
memory/1616-97-0x000007FEFE910000-0x000007FEFE9AF000-memory.dmp
memory/1616-98-0x0000000076CF0000-0x0000000076E0F000-memory.dmp
memory/1616-99-0x000007FEFCEB0000-0x000007FEFCF1C000-memory.dmp
memory/1616-104-0x000007FEFF0A0000-0x000007FEFF1CD000-memory.dmp
memory/1616-101-0x000007FEF62A0000-0x000007FEF6397000-memory.dmp
memory/1616-102-0x000007FEFD7E0000-0x000007FEFD8BB000-memory.dmp
memory/1616-103-0x000007FEF4C80000-0x000007FEF566C000-memory.dmp
memory/1768-84-0x0000000002984000-0x0000000002987000-memory.dmp
memory/1768-74-0x000007FEFB931000-0x000007FEFB933000-memory.dmp
memory/1768-86-0x000000000298B000-0x00000000029AA000-memory.dmp
memory/1768-85-0x0000000002984000-0x0000000002987000-memory.dmp
memory/1768-83-0x000000001B710000-0x000000001BA0F000-memory.dmp
memory/1768-79-0x000007FEECEC0000-0x000007FEED8E3000-memory.dmp
memory/1768-82-0x000007FEF5500000-0x000007FEF605D000-memory.dmp
memory/1936-138-0x0000000001EE0000-0x00000000020C4000-memory.dmp
memory/1936-89-0x0000000001EE0000-0x00000000020C4000-memory.dmp
memory/1956-71-0x00000000012F0000-0x00000000014D4000-memory.dmp
memory/1956-63-0x000007FEF64F0000-0x000007FEF65E7000-memory.dmp
memory/1956-59-0x000007FEFE910000-0x000007FEFE9AF000-memory.dmp
memory/1956-58-0x0000000076E10000-0x0000000076F0A000-memory.dmp
memory/1956-57-0x000007FEFD200000-0x000007FEFD267000-memory.dmp
memory/1956-56-0x000007FEFA880000-0x000007FEFA91C000-memory.dmp
memory/1956-61-0x000007FEFCEB0000-0x000007FEFCF1C000-memory.dmp
memory/1956-70-0x000007FEFB580000-0x000007FEFB5D6000-memory.dmp
memory/1956-62-0x000007FEFD2C0000-0x000007FEFD331000-memory.dmp
memory/1956-81-0x0000000000510000-0x0000000000551000-memory.dmp
memory/1956-80-0x00000000012F0000-0x00000000014D4000-memory.dmp
memory/1956-67-0x0000000000510000-0x0000000000551000-memory.dmp
memory/1956-69-0x000007FEFD3A0000-0x000007FEFD5A3000-memory.dmp
memory/1956-68-0x000007FEFF0A0000-0x000007FEFF1CD000-memory.dmp
memory/1956-76-0x000007FEFD2A0000-0x000007FEFD2BF000-memory.dmp
memory/1956-60-0x0000000076CF0000-0x0000000076E0F000-memory.dmp
memory/1956-66-0x00000000012F0000-0x00000000014D4000-memory.dmp
memory/1956-65-0x000007FEF5670000-0x000007FEF605C000-memory.dmp
memory/1956-72-0x000007FEF6270000-0x000007FEF639C000-memory.dmp
memory/1956-55-0x000007FEFA5D0000-0x000007FEFA63F000-memory.dmp
memory/1956-64-0x000007FEFD7E0000-0x000007FEFD8BB000-memory.dmp
memory/2044-139-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-140-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-142-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-144-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-146-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-149-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-150-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-164-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2044-165-0x0000000140000000-0x00000001407C9000-memory.dmp