xmrig | 7ff87dcb5532a742f2220e1e0a621ac802a1130109562f284b6083ec87274a6d

Analysis

max time kernel
121s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2023 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PentagonRAT/PentagonRAT Final Relasex.exe
Size

14.3MB
MD5

f087be9767a592fe6c3dcd79c5263f9d
SHA1

e81da1cac167705c60ea6831b6941b2b4aa3814d
SHA256

af43615598656605d2d8ce83fcecbe798456859bcd54acd5da3ce02de4dd5527
SHA512

c9d3cb29b7387999e49576afbcab850b2bd3e1769438e5c584c2d78c4e05236de40ef85885b463b4c197afe6c32e93a8ac95d02dd350841d69895ce5f3b26559
SSDEEP

393216:TWQtr5uX5PHGBhMVpwygcrzw9WrPTEPjyko:/tFuJvY65gc3mCPwe

Score

10^/10

xmrig evasion miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

Processes:

resource	yara_rule
behavioral6/memory/3472-162-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-163-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-164-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-165-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-166-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-167-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-180-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-186-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-187-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-193-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-196-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-197-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-198-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-199-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-200-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-201-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-202-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral6/memory/3472-203-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig

Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

480 netsh.exe
116 netsh.exe

pid	process
480	netsh.exe
116	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

PentagonRAT Final Relasex.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	PentagonRAT Final Relasex.exe

Executes dropped EXE 2 IoCs

Processes:

TiWorker.exePentagonRAT Final Relase.exe

pid process

3472 TiWorker.exe
1892 PentagonRAT Final Relase.exe

pid	process
3472	TiWorker.exe
1892	PentagonRAT Final Relase.exe

Drops file in System32 directory 6 IoCs

Processes:

PentagonRAT Final Relasex.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TiWorker.exe	PentagonRAT Final Relasex.exe
File opened for modification	C:\Windows\SysWOW64\TiWorker.exe	PentagonRAT Final Relasex.exe
File created	C:\Windows\SysWOW64\config.json	PentagonRAT Final Relasex.exe
File opened for modification	C:\Windows\SysWOW64\config.json	PentagonRAT Final Relasex.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.xml	PentagonRAT Final Relasex.exe
File opened for modification	C:\Windows\SysWOW64\MicrosoftWindows.xml	PentagonRAT Final Relasex.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4248 schtasks.exe

pid	process
4248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

PentagonRAT Final Relasex.exe

pid	process
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe
3236	PentagonRAT Final Relasex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

TiWorker.exe

description pid process

Token: SeLockMemoryPrivilege 3472 TiWorker.exe

description	pid	process
Token: SeLockMemoryPrivilege	3472	TiWorker.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

PentagonRAT Final Relasex.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3236 wrote to memory of 2024	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 2024	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 2024 wrote to memory of 2180	2024	cmd.exe	schtasks.exe
PID 2024 wrote to memory of 2180	2024	cmd.exe	schtasks.exe
PID 2024 wrote to memory of 1812	2024	cmd.exe	schtasks.exe
PID 2024 wrote to memory of 1812	2024	cmd.exe	schtasks.exe
PID 3236 wrote to memory of 1936	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 1936	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 1936 wrote to memory of 2188	1936	cmd.exe	schtasks.exe
PID 1936 wrote to memory of 2188	1936	cmd.exe	schtasks.exe
PID 3236 wrote to memory of 3668	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 3668	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3668 wrote to memory of 480	3668	cmd.exe	netsh.exe
PID 3668 wrote to memory of 480	3668	cmd.exe	netsh.exe
PID 3236 wrote to memory of 4348	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 4348	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 4348 wrote to memory of 116	4348	cmd.exe	netsh.exe
PID 4348 wrote to memory of 116	4348	cmd.exe	netsh.exe
PID 3236 wrote to memory of 4424	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 4424	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 4424 wrote to memory of 4248	4424	cmd.exe	schtasks.exe
PID 4424 wrote to memory of 4248	4424	cmd.exe	schtasks.exe
PID 3236 wrote to memory of 5072	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 5072	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 5072 wrote to memory of 2224	5072	cmd.exe	schtasks.exe
PID 5072 wrote to memory of 2224	5072	cmd.exe	schtasks.exe
PID 5072 wrote to memory of 4128	5072	cmd.exe	schtasks.exe
PID 5072 wrote to memory of 4128	5072	cmd.exe	schtasks.exe
PID 3236 wrote to memory of 4020	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 3236 wrote to memory of 4020	3236	PentagonRAT Final Relasex.exe	cmd.exe
PID 4020 wrote to memory of 3792	4020	cmd.exe	certutil.exe
PID 4020 wrote to memory of 3792	4020	cmd.exe	certutil.exe
PID 3236 wrote to memory of 1892	3236	PentagonRAT Final Relasex.exe	PentagonRAT Final Relase.exe
PID 3236 wrote to memory of 1892	3236	PentagonRAT Final Relasex.exe	PentagonRAT Final Relase.exe
PID 3236 wrote to memory of 1892	3236	PentagonRAT Final Relasex.exe	PentagonRAT Final Relase.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PentagonRAT\PentagonRAT Final Relasex.exe
"C:\Users\Admin\AppData\Local\Temp\PentagonRAT\PentagonRAT Final Relasex.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\system32\schtasks.exe
schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
3⤵
PID:2180

C:\Windows\system32\schtasks.exe
schtasks /End /TN "WindowsUpdate"
3⤵
PID:1812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\system32\schtasks.exe
schtasks /Delete /TN "WindowsUpdate" /F
3⤵
PID:2188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3668

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4348

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\system32\schtasks.exe
schtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
3⤵
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:5072

C:\Windows\system32\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"
3⤵
PID:2224

C:\Windows\system32\schtasks.exe
schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
3⤵
PID:4128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4020

C:\Windows\system32\certutil.exe
certutil –addstore –f root MicrosoftWindows.crt
3⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\PentagonRAT\PentagonRAT Final Relase.exe
"C:\Users\Admin\AppData\Local\Temp\PentagonRAT\PentagonRAT Final Relase.exe"
2⤵
- Executes dropped EXE
PID:1892

C:\Windows\SysWOW64\TiWorker.exe
C:\Windows\SysWOW64\TiWorker.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicrosoftWindows.crt
Filesize
1KB

MD5
1bb617d3aab1dbe2ec2e4a90bf824846

SHA1
bbe179f1bdc4466661da3638420e6ca862bd50ca

SHA256
1bf4ce2aedc0cfb1365ab15c7e0c8c26b87890ad4008d56317b756b8745ff580

SHA512
ed91750bec3aed806088c271e295550dac1c8cae91569f278d40fbd671b486e70cc9b28f7a9a70e9f340fbe8a038f1ed18f666de4246fc1d60e015e0dd3f1c52

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicrosoftWindows.crt
Filesize
1KB

MD5
1bb617d3aab1dbe2ec2e4a90bf824846

SHA1
bbe179f1bdc4466661da3638420e6ca862bd50ca

SHA256
1bf4ce2aedc0cfb1365ab15c7e0c8c26b87890ad4008d56317b756b8745ff580

SHA512
ed91750bec3aed806088c271e295550dac1c8cae91569f278d40fbd671b486e70cc9b28f7a9a70e9f340fbe8a038f1ed18f666de4246fc1d60e015e0dd3f1c52

Download Submit
C:\Users\Admin\AppData\Local\Temp\PentagonRAT\PentagonRAT Final Relase.exe
Filesize
14.3MB

MD5
301f4d25cae53df616e924d441aa1b39

SHA1
7cf05228251c4de97de37dadbdaba161175d9fb6

SHA256
35fcea7e34355401510fda5f10354a7d679bf80779f5221912e1c0377b3a60b4

SHA512
93625584609395f27f9f6f9dd9559247ee56f26ba40ffc54e3fd79c7aa3bc9a16086dd598491374c9f0341be904d3424e63f7fa0c7c5fbc61154114df7db7376

Download Submit
C:\Users\Admin\AppData\Local\Temp\PentagonRAT\PentagonRAT Final Relase.exe
Filesize
14.3MB

MD5
301f4d25cae53df616e924d441aa1b39

SHA1
7cf05228251c4de97de37dadbdaba161175d9fb6

SHA256
35fcea7e34355401510fda5f10354a7d679bf80779f5221912e1c0377b3a60b4

SHA512
93625584609395f27f9f6f9dd9559247ee56f26ba40ffc54e3fd79c7aa3bc9a16086dd598491374c9f0341be904d3424e63f7fa0c7c5fbc61154114df7db7376

Download Submit
C:\Users\Admin\AppData\Local\Temp\autED81.tmp
Filesize
3.2MB

MD5
ecede3c32ce83ff76ae584c938512c5a

SHA1
090b15025e131cc03098f6f0d8fa5366bc5fa1f0

SHA256
366f1e9f9c99aa81034bada3cc344f2fb5a74246e1d5851441244df1ecc9ae6d

SHA512
61ca6075c8a2086d42b58698484afc0005645507474831cacafc10126f47c8f0cda10c1c215557f9391865b55b16ae881a593d7547cbad560b54369684b23d1d

Download Submit
C:\Windows\SysWOW64\MicrosoftWindows.xml
Filesize
4KB

MD5
b1cbfcc7b7a5716a30b77f5dc5bb6135

SHA1
5c397ffd7a845b2fdf9e82ff73698784a91a2fb9

SHA256
96f2ff4ddcadf6421071daa6cdda2ce866fb7b10d12cc1b20bd07cb131210430

SHA512
d08516e7610e5a08d1c5c2d1cc5a22b1cd2d6b7c890f895caee0cf65577a1315d575d91a8f7f78ffc7bd0dd77b23ece46fadf58ba44257a115330a54a3ebfcf7

Download Submit
C:\Windows\SysWOW64\TiWorker.exe
Filesize
3.2MB

MD5
ecede3c32ce83ff76ae584c938512c5a

SHA1
090b15025e131cc03098f6f0d8fa5366bc5fa1f0

SHA256
366f1e9f9c99aa81034bada3cc344f2fb5a74246e1d5851441244df1ecc9ae6d

SHA512
61ca6075c8a2086d42b58698484afc0005645507474831cacafc10126f47c8f0cda10c1c215557f9391865b55b16ae881a593d7547cbad560b54369684b23d1d

Download Submit
C:\Windows\SysWOW64\config.json
Filesize
1011B

MD5
3da156f2d3307118a8e2c569be30bc87

SHA1
335678ca235af3736677bd8039e25a6c1ee5efca

SHA256
f86ab68eaddd22fbe679ea5ab9cc54775e74081beffd758b30776ba103f396eb

SHA512
59748e02cc4b7f280471b411d6ca3c9986f4c12f84b039bae25269634fc825cde417fe46246f58538668c19cca91e698e31d9f32df69aad89e68423f86bb00c0

Download Submit
\??\c:\windows\syswow64\tiworker.exe
Filesize
3.2MB

MD5
ecede3c32ce83ff76ae584c938512c5a

SHA1
090b15025e131cc03098f6f0d8fa5366bc5fa1f0

SHA256
366f1e9f9c99aa81034bada3cc344f2fb5a74246e1d5851441244df1ecc9ae6d

SHA512
61ca6075c8a2086d42b58698484afc0005645507474831cacafc10126f47c8f0cda10c1c215557f9391865b55b16ae881a593d7547cbad560b54369684b23d1d

Download Submit
memory/1892-185-0x0000000006790000-0x00000000067A0000-memory.dmp

Filesize
64KB

Download
memory/1892-195-0x0000000006790000-0x00000000067A0000-memory.dmp

Filesize
64KB

Download
memory/1892-189-0x000000000E2A0000-0x000000000E794000-memory.dmp

Filesize
5.0MB

Download
memory/1892-188-0x0000000006790000-0x00000000067A0000-memory.dmp

Filesize
64KB

Download
memory/1892-194-0x0000000006790000-0x00000000067A0000-memory.dmp

Filesize
64KB

Download
memory/1892-190-0x0000000006790000-0x00000000067A0000-memory.dmp

Filesize
64KB

Download
memory/1892-192-0x0000000006790000-0x00000000067A0000-memory.dmp

Filesize
64KB

Download
memory/1892-183-0x00000000068B0000-0x0000000006906000-memory.dmp

Filesize
344KB

Download
memory/1892-177-0x0000000000E80000-0x0000000001CDA000-memory.dmp

Filesize
14.4MB

Download
memory/1892-178-0x0000000006670000-0x000000000670C000-memory.dmp

Filesize
624KB

Download
memory/1892-179-0x0000000006CC0000-0x0000000007264000-memory.dmp

Filesize
5.6MB

Download
memory/1892-184-0x0000000006A30000-0x0000000006A6E000-memory.dmp

Filesize
248KB

Download
memory/1892-181-0x00000000067B0000-0x0000000006842000-memory.dmp

Filesize
584KB

Download
memory/1892-182-0x0000000006740000-0x000000000674A000-memory.dmp

Filesize
40KB

Download
memory/3472-164-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-180-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-167-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-186-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-187-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-166-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-165-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-163-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-162-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-193-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-159-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-158-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-196-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-197-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-198-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-199-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-200-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-201-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-202-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download
memory/3472-203-0x0000000000400000-0x0000000000DCB000-memory.dmp

Filesize
9.8MB

Download