Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
15/03/2023, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
8 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
2.0MB
-
MD5
6d93b061d562ae7c75c456b33de8c1d5
-
SHA1
ae0981d25717a3e14a493bbc5d0678b3a4654703
-
SHA256
df8bd0989f4072a578b6e5f471cb15c3377ae064fd3813cce5f4b2ce15471c33
-
SHA512
48eaa413cb7c016197498a168ee539e0108fbd4b25212c6596780603e135e36a5369a24412b59d5b996aa3906e0d71b52c35d28f60be20b30ea21aa53f309a8d
-
SSDEEP
49152:DHHelAXAn04I+L3aMFUaJstQTL1oOKsOP+R:DnelcY04I+LKh4sGVoTOR
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 932 created 1296 932 tmp.exe 17 PID 932 created 1296 932 tmp.exe 17 -
XMRig Miner payload 10 IoCs
resource yara_rule behavioral1/memory/1748-66-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-67-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-68-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-69-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-70-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-71-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-72-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-73-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-74-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1748-75-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/1748-66-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-67-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-68-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-69-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-70-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-71-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-72-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-73-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-74-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1748-75-0x0000000140000000-0x00000001407F4000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 932 set thread context of 1748 932 tmp.exe 31 -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 932 tmp.exe 932 tmp.exe 932 tmp.exe 932 tmp.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe 1748 conhost.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1352 WMIC.exe Token: SeSecurityPrivilege 1352 WMIC.exe Token: SeTakeOwnershipPrivilege 1352 WMIC.exe Token: SeLoadDriverPrivilege 1352 WMIC.exe Token: SeSystemProfilePrivilege 1352 WMIC.exe Token: SeSystemtimePrivilege 1352 WMIC.exe Token: SeProfSingleProcessPrivilege 1352 WMIC.exe Token: SeIncBasePriorityPrivilege 1352 WMIC.exe Token: SeCreatePagefilePrivilege 1352 WMIC.exe Token: SeBackupPrivilege 1352 WMIC.exe Token: SeRestorePrivilege 1352 WMIC.exe Token: SeShutdownPrivilege 1352 WMIC.exe Token: SeDebugPrivilege 1352 WMIC.exe Token: SeSystemEnvironmentPrivilege 1352 WMIC.exe Token: SeRemoteShutdownPrivilege 1352 WMIC.exe Token: SeUndockPrivilege 1352 WMIC.exe Token: SeManageVolumePrivilege 1352 WMIC.exe Token: 33 1352 WMIC.exe Token: 34 1352 WMIC.exe Token: 35 1352 WMIC.exe Token: SeIncreaseQuotaPrivilege 1352 WMIC.exe Token: SeSecurityPrivilege 1352 WMIC.exe Token: SeTakeOwnershipPrivilege 1352 WMIC.exe Token: SeLoadDriverPrivilege 1352 WMIC.exe Token: SeSystemProfilePrivilege 1352 WMIC.exe Token: SeSystemtimePrivilege 1352 WMIC.exe Token: SeProfSingleProcessPrivilege 1352 WMIC.exe Token: SeIncBasePriorityPrivilege 1352 WMIC.exe Token: SeCreatePagefilePrivilege 1352 WMIC.exe Token: SeBackupPrivilege 1352 WMIC.exe Token: SeRestorePrivilege 1352 WMIC.exe Token: SeShutdownPrivilege 1352 WMIC.exe Token: SeDebugPrivilege 1352 WMIC.exe Token: SeSystemEnvironmentPrivilege 1352 WMIC.exe Token: SeRemoteShutdownPrivilege 1352 WMIC.exe Token: SeUndockPrivilege 1352 WMIC.exe Token: SeManageVolumePrivilege 1352 WMIC.exe Token: 33 1352 WMIC.exe Token: 34 1352 WMIC.exe Token: 35 1352 WMIC.exe Token: SeLockMemoryPrivilege 1748 conhost.exe Token: SeLockMemoryPrivilege 1748 conhost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1352 1736 cmd.exe 29 PID 1736 wrote to memory of 1352 1736 cmd.exe 29 PID 1736 wrote to memory of 1352 1736 cmd.exe 29 PID 932 wrote to memory of 1748 932 tmp.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:932
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"2⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe mqwjzullwzvwenmy XofLACsdV31j9ZQMDeZoqCpNDgH0IbRDCo8NYw9+P4JwfjP3r8juDbWUJ7APXIjo7KQQj7cKEm5oQsoDQN8Efviq2kZkCX3Ph6wllPLu4W9N9e1jf2eCKRyOvcKwSHpYRguTnzshTjEwmSgeDnFzlaXjgP/UH3/Zk3VOFzXD7J4bl36lB93CYxsaLyi7SYriWjv2i8s3IK5VIiXtwqg8e1mLOKjfmqNf5uqPi5/B2ntJLFZ32GQeLidY8qFG/DFpgjuA3OWVN5F65GC29/06CAHJNrcfvSX78mwnOOCa8fJq4pqqkliEOzy1ZJlifM1LnsKLioY8YeyaU44AwhJOhnoPIbb3ewsesKNoA2T1fJjQwdxlFzP8fqNiL+63oxQLo5gznyy+hdtr4jShxXOOFXLalo7NXZbrpJJ3bldWOJNs9mliwYJAfDEa2ii7a0m32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5