Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 09:51
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20231215-en
General
-
Target
tmp.exe
-
Size
6.0MB
-
MD5
66055eb5779265037160e80546c6de3d
-
SHA1
49d3ac6f095af87c2940b16f52f1c72b81646b0d
-
SHA256
6fc7bfc186b8207bcb43a0b012cf8aaa20b9c59ba3582ee48635044abaa1598e
-
SHA512
a315bc889e9f629dd0bb0c8a376ee29f3fcd25706a2ad0511db1292e5d18b76392e857b4db1010b2b1ce6d7ea1f81d94b6dcbcbdd565d456565fa2a36aa152fc
-
SSDEEP
98304:wUQqpYQUHxoPmuVk77pC9RwQic/WkkQldxy6Qn3g64UFkcSJNsPGw7Wb/DibBZNY:wjqi+PS7Qf+OdkExPTpUC+Gwqb/DiNzY
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
tmp.exedescription pid process target process PID 1728 created 3376 1728 tmp.exe Explorer.EXE -
XMRig Miner payload 10 IoCs
Processes:
resource yara_rule behavioral2/memory/648-50-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-51-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-52-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-54-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-55-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-56-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-57-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-58-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-59-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/648-61-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
VCDDaemon.exepid process 3184 VCDDaemon.exe -
Loads dropped DLL 4 IoCs
Processes:
VCDDaemon.exepid process 3184 VCDDaemon.exe 3184 VCDDaemon.exe 3184 VCDDaemon.exe 3184 VCDDaemon.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
VCDDaemon.execmd.exeMSBuild.exedescription pid process target process PID 3184 set thread context of 568 3184 VCDDaemon.exe cmd.exe PID 568 set thread context of 3412 568 cmd.exe MSBuild.exe PID 3412 set thread context of 648 3412 MSBuild.exe ngen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
tmp.exeVCDDaemon.execmd.exeMSBuild.exepid process 1728 tmp.exe 1728 tmp.exe 3184 VCDDaemon.exe 3184 VCDDaemon.exe 568 cmd.exe 568 cmd.exe 3412 MSBuild.exe 3412 MSBuild.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 676 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
VCDDaemon.execmd.exepid process 3184 VCDDaemon.exe 568 cmd.exe 568 cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
MSBuild.exengen.exedescription pid process Token: SeDebugPrivilege 3412 MSBuild.exe Token: SeLockMemoryPrivilege 648 ngen.exe Token: SeLockMemoryPrivilege 648 ngen.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ngen.exepid process 648 ngen.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
tmp.exepid process 1728 tmp.exe 1728 tmp.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
tmp.exeVCDDaemon.execmd.exeMSBuild.exedescription pid process target process PID 1728 wrote to memory of 3184 1728 tmp.exe VCDDaemon.exe PID 1728 wrote to memory of 3184 1728 tmp.exe VCDDaemon.exe PID 1728 wrote to memory of 3184 1728 tmp.exe VCDDaemon.exe PID 3184 wrote to memory of 568 3184 VCDDaemon.exe cmd.exe PID 3184 wrote to memory of 568 3184 VCDDaemon.exe cmd.exe PID 3184 wrote to memory of 568 3184 VCDDaemon.exe cmd.exe PID 3184 wrote to memory of 568 3184 VCDDaemon.exe cmd.exe PID 568 wrote to memory of 3412 568 cmd.exe MSBuild.exe PID 568 wrote to memory of 3412 568 cmd.exe MSBuild.exe PID 568 wrote to memory of 3412 568 cmd.exe MSBuild.exe PID 568 wrote to memory of 3412 568 cmd.exe MSBuild.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe PID 3412 wrote to memory of 648 3412 MSBuild.exe ngen.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeC:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe --donate-level 1 -o de.zephyr.herominers.com:1123 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p workwork -a rx/0 -k --max-cpu-usage=505⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\17f33b40Filesize
2.1MB
MD585dc900b68e0b5c3e277b14e891e7b1c
SHA1bc8efe8d6c874122a2e9e118b2f7a50801799d6d
SHA2561c7f0713d6cbeb14d2ca37ca4a80b1f148cbae8b7267c2c674ce7a35e51c1764
SHA512242c5e65838a1986f49397142a21168cd22adecd157d95021d35525e3fe02ab608fdd91761edc792606afccd74dd04adaf561d84a7dbee9c78b1ee732cdfbbdc
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyCDIO.dllFilesize
93KB
MD55abcd9f2323d7e4ac51728cc32f17cc6
SHA1b226b10309a38cb1e30a00bce541cbf62e3dc0e0
SHA256cff34dfd4251c22458f73674e6d2e1ca4c38a2ca7d69491db291e89c929d823b
SHA5123b87c46047611fb491e82b6903694567965fc475337c437098b124679b231bfe47add75537fef26c78d8b87844700eca414c4d9e3f5a065d7f54286cb4f69254
-
C:\Users\Admin\AppData\Roaming\msdt\ElbyVCD.dllFilesize
130KB
MD5aa490720cd3c26eff6e6fbe9601673a5
SHA1e97dbbd6b37bff2c700e1ce967cf6612fddfbd41
SHA256349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df
SHA512fb2347bd7d6f0408235f30468886da8e4ec4790058ed70dbb28a4080b399a9b55902aa33756209cb3ed8579347ca69d484cb12f6e7ef0120246c3ac37ef98647
-
C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exeFilesize
86KB
MD53bd79a1f6d2ea0fddea3f8914b2a6a0c
SHA13ea3f44f81b3501e652b448a7dc33a8ee739772e
SHA256332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
SHA5127bbb3f3af90443803f7689c973a64f894fb48bd744ab0c70af7dfa7c763354dc6f67a7fbb7053d38b0c6611b0aaa532e73eb2579c1445b8a31c573f8bf972a67
-
C:\Users\Admin\AppData\Roaming\msdt\poppet.epsFilesize
1.8MB
MD5d0a7fae3a0fdae716c76300adf70b2bb
SHA15be0788226f428dcc66de7aa4dce5d8eeb832d8e
SHA256f1d7eb55fcaf9a6f71316559e33d40682f47ce3c0b1c1ff4908c71ca1015c9ed
SHA5121306f6fba2386a31dffb80297a089285f3045b1c19950a1068a5a3103f06467cda71650c23efc0ba59fd3e35482d1fe362f7713e2f8da965fed97151f85cd5a1
-
memory/568-36-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/568-31-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/568-38-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/568-35-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/568-33-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmpFilesize
2.0MB
-
memory/648-58-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-57-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-56-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-55-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-54-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-53-0x00000272276E0000-0x0000027227700000-memory.dmpFilesize
128KB
-
memory/648-50-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-52-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-59-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-60-0x0000027229100000-0x0000027229140000-memory.dmpFilesize
256KB
-
memory/648-51-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/648-61-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/1728-28-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/1728-0-0x0000000000400000-0x00000000006F1000-memory.dmpFilesize
2.9MB
-
memory/1728-6-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/1728-3-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/1728-2-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmpFilesize
2.0MB
-
memory/1728-13-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/1728-1-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/3184-25-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/3184-29-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/3184-27-0x0000000074BC0000-0x0000000074D3B000-memory.dmpFilesize
1.5MB
-
memory/3184-26-0x00007FF935AB0000-0x00007FF935CA5000-memory.dmpFilesize
2.0MB
-
memory/3184-23-0x0000000000470000-0x0000000000488000-memory.dmpFilesize
96KB
-
memory/3412-39-0x00007FF9161E0000-0x00007FF917857000-memory.dmpFilesize
22.5MB
-
memory/3412-46-0x00000281E4ED0000-0x00000281E4EE0000-memory.dmpFilesize
64KB
-
memory/3412-42-0x0000000000400000-0x0000000000578000-memory.dmpFilesize
1.5MB
-
memory/3412-45-0x00007FF915660000-0x00007FF916121000-memory.dmpFilesize
10.8MB
-
memory/3412-44-0x00000281E4ED0000-0x00000281E4EE0000-memory.dmpFilesize
64KB
-
memory/3412-43-0x00007FF915660000-0x00007FF916121000-memory.dmpFilesize
10.8MB
-
memory/3412-67-0x00007FF915660000-0x00007FF916121000-memory.dmpFilesize
10.8MB