Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04-04-2023 05:13

General

  • Target

    33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe

  • Size

    62KB

  • MD5

    09a29f3b529c5e9ab25a47973bb0900a

  • SHA1

    b8dce851d01dbe0335f11fa8449b52a2270776e6

  • SHA256

    33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a

  • SHA512

    35e92a26fc392b15eb7fd78ca1f6a6c08afe42ed535fd020237215d7f4db0f66fa0676eb70d646f8790c9724c30c605a99b33cf6a6c84c3de78f6061f1a48efb

  • SSDEEP

    1536:s2JbaiIZApuLzOgkx9MbEze4g3ViceSITKdU:dbahZApuL1kx9MbEze4g3ViceYO

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 6 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe
    "C:\Users\Admin\AppData\Local\Temp\33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:3516
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4332
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1488
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4264
            • C:\Windows\SysWOW64\schtasks.exe
              SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Creates scheduled task(s)
              PID:3156
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:3076
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk1960" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:4312
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5401" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:2804
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5401" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4580
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8223" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2880
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8223" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:3680
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4492" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4836
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4492" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:2868
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4804
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:3552
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4576
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:4796
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2052
                  • C:\Windows\SysWOW64\schtasks.exe
                    SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    4⤵
                    • Creates scheduled task(s)
                    PID:5008
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:3864
                    • C:\Windows\SysWOW64\schtasks.exe
                      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      4⤵
                      • Creates scheduled task(s)
                      PID:3348
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:3456
                      • C:\Windows\SysWOW64\schtasks.exe
                        SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        4⤵
                        • Creates scheduled task(s)
                        PID:4676
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:400
                        • C:\Windows\SysWOW64\schtasks.exe
                          SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                          4⤵
                          • Creates scheduled task(s)
                          PID:3728
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
                        3⤵
                          PID:2276
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 1251
                            4⤵
                              PID:2064
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
                            3⤵
                              PID:2092
                              • C:\Windows\SysWOW64\chcp.com
                                chcp 1251
                                4⤵
                                  PID:4100
                                • C:\ProgramData\Dllhost\winlogson.exe
                                  C:\ProgramData\Dllhost\winlogson.exe -c config.json
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4104
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
                                3⤵
                                  PID:1068
                                  • C:\Windows\SysWOW64\chcp.com
                                    chcp 1251
                                    4⤵
                                      PID:1852
                                    • C:\ProgramData\Dllhost\winlogson.exe
                                      C:\ProgramData\Dllhost\winlogson.exe -c config.json
                                      4⤵
                                      • Executes dropped EXE
                                      PID:2672

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                24KB

                                MD5

                                acf4152befc5768daaf11c92fd3899b0

                                SHA1

                                f8a210a2a00876f15008f275063988e5cf534722

                                SHA256

                                64c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6

                                SHA512

                                15bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1

                              • C:\ProgramData\Dllhost\dllhost.exe

                                Filesize

                                24KB

                                MD5

                                acf4152befc5768daaf11c92fd3899b0

                                SHA1

                                f8a210a2a00876f15008f275063988e5cf534722

                                SHA256

                                64c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6

                                SHA512

                                15bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1

                              • C:\ProgramData\Dllhost\winlogson.exe

                                Filesize

                                5.2MB

                                MD5

                                6c454e10bbea489cfc96253fe55ec282

                                SHA1

                                22fd5c79495ad06036635eff26a31c76d859e3b7

                                SHA256

                                a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7

                                SHA512

                                81f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562

                              • C:\ProgramData\Dllhost\winlogson.exe

                                Filesize

                                5.2MB

                                MD5

                                6c454e10bbea489cfc96253fe55ec282

                                SHA1

                                22fd5c79495ad06036635eff26a31c76d859e3b7

                                SHA256

                                a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7

                                SHA512

                                81f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562

                              • C:\ProgramData\Dllhost\winlogson.exe

                                Filesize

                                5.2MB

                                MD5

                                6c454e10bbea489cfc96253fe55ec282

                                SHA1

                                22fd5c79495ad06036635eff26a31c76d859e3b7

                                SHA256

                                a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7

                                SHA512

                                81f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562

                              • C:\ProgramData\SystemFiles\sys_rh.bin

                                Filesize

                                1KB

                                MD5

                                9bc83276af97842def832a8e4a57ff89

                                SHA1

                                f9412e836938d2e67b1681ef562955218568bd74

                                SHA256

                                33f0be926c68f749a4fbede88a55ee546e00dd9041ec762a6d491d30b2286492

                                SHA512

                                161c14dcc27cd66ee2c77dc959308a7c5aa1d94da356cd663cf93e4aa47b3eb54e1f799f9e4f202bc9fea2af84043899ce829954e85f50deb320a7ce9ec3d9ac

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                Filesize

                                2KB

                                MD5

                                1c19c16e21c97ed42d5beabc93391fc5

                                SHA1

                                8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                SHA256

                                1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                SHA512

                                7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                Filesize

                                18KB

                                MD5

                                fda770214747906e07a1ee6b6ff283c4

                                SHA1

                                80f0c854e17ae4605349c2bb7c0a791cce942334

                                SHA256

                                df67f50693e65f959b297e6bcc63557ae05dc8074cc6393a0e2df30600e33ab6

                                SHA512

                                331428d25e86cd759d588d242f37c17f685cbddfe964198437e69d05e23364189d1fdac7f2f82199edbf684a18f88c19337b5a9a0c2a232cd040c95683543a69

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b0ftbbc1.tga.ps1

                                Filesize

                                1B

                                MD5

                                c4ca4238a0b923820dcc509a6f75849b

                                SHA1

                                356a192b7913b04c54574d18c28d46e6395428ab

                                SHA256

                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                SHA512

                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                              • memory/1488-409-0x000000007E870000-0x000000007E880000-memory.dmp

                                Filesize

                                64KB

                              • memory/1488-410-0x00000000044D0000-0x00000000044E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1488-387-0x00000000044D0000-0x00000000044E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/1488-386-0x00000000044D0000-0x00000000044E0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2656-656-0x0000000004D40000-0x0000000004D50000-memory.dmp

                                Filesize

                                64KB

                              • memory/2656-520-0x0000000004D40000-0x0000000004D50000-memory.dmp

                                Filesize

                                64KB

                              • memory/2656-484-0x0000000000330000-0x000000000033C000-memory.dmp

                                Filesize

                                48KB

                              • memory/3648-119-0x00000000006A0000-0x00000000006B6000-memory.dmp

                                Filesize

                                88KB

                              • memory/3648-125-0x0000000006330000-0x0000000006396000-memory.dmp

                                Filesize

                                408KB

                              • memory/3648-124-0x0000000005170000-0x000000000517A000-memory.dmp

                                Filesize

                                40KB

                              • memory/3648-123-0x0000000005180000-0x0000000005190000-memory.dmp

                                Filesize

                                64KB

                              • memory/3648-122-0x0000000005230000-0x00000000052C2000-memory.dmp

                                Filesize

                                584KB

                              • memory/3648-121-0x0000000009C10000-0x000000000A10E000-memory.dmp

                                Filesize

                                5.0MB

                              • memory/3648-120-0x0000000004F70000-0x0000000004F76000-memory.dmp

                                Filesize

                                24KB

                              • memory/3648-243-0x0000000005180000-0x0000000005190000-memory.dmp

                                Filesize

                                64KB

                              • memory/4104-663-0x000001BDEF660000-0x000001BDEF680000-memory.dmp

                                Filesize

                                128KB

                              • memory/4332-131-0x0000000006E80000-0x00000000074A8000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/4332-367-0x0000000009240000-0x0000000009248000-memory.dmp

                                Filesize

                                32KB

                              • memory/4332-362-0x0000000009250000-0x000000000926A000-memory.dmp

                                Filesize

                                104KB

                              • memory/4332-167-0x00000000092A0000-0x0000000009334000-memory.dmp

                                Filesize

                                592KB

                              • memory/4332-166-0x0000000006840000-0x0000000006850000-memory.dmp

                                Filesize

                                64KB

                              • memory/4332-165-0x000000007EDA0000-0x000000007EDB0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4332-164-0x0000000009000000-0x00000000090A5000-memory.dmp

                                Filesize

                                660KB

                              • memory/4332-159-0x0000000008FA0000-0x0000000008FBE000-memory.dmp

                                Filesize

                                120KB

                              • memory/4332-158-0x0000000008FC0000-0x0000000008FF3000-memory.dmp

                                Filesize

                                204KB

                              • memory/4332-137-0x0000000007ED0000-0x0000000007F46000-memory.dmp

                                Filesize

                                472KB

                              • memory/4332-136-0x0000000007C30000-0x0000000007C7B000-memory.dmp

                                Filesize

                                300KB

                              • memory/4332-135-0x0000000007820000-0x000000000783C000-memory.dmp

                                Filesize

                                112KB

                              • memory/4332-134-0x0000000007860000-0x0000000007BB0000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/4332-133-0x0000000007520000-0x0000000007586000-memory.dmp

                                Filesize

                                408KB

                              • memory/4332-132-0x0000000006E30000-0x0000000006E52000-memory.dmp

                                Filesize

                                136KB

                              • memory/4332-130-0x0000000006840000-0x0000000006850000-memory.dmp

                                Filesize

                                64KB

                              • memory/4332-129-0x0000000006840000-0x0000000006850000-memory.dmp

                                Filesize

                                64KB

                              • memory/4332-128-0x0000000006760000-0x0000000006796000-memory.dmp

                                Filesize

                                216KB