Analysis
- max time kernel
149s - max time network
141s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
02/03/2024, 15:37
General
- Target AI WF GOOGLE.exe
- Size 17.9MB
- Sample240302-s2q18aef41
- SHA256 5dc5de381947ec24c3c3fcec600c354299ee50265c7ce66daf95a1f12d1d86f3
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 16 IoCs
- Creates new service(s) 1 TTPs
- Stops running service(s) 3 TTPs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AI WF GOOGLE.exe"C:\Users\Admin\AppData\Local\Temp\AI WF GOOGLE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
-
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dckuybanmlgp.exe
dckuybanmlgp.exe
dckuybanmlgp.exe
dckuybanmlgp.exe
memory/2224-0-0x0000000077670000-0x0000000077672000-memory.dmp
memory/2224-2-0x0000000077670000-0x0000000077672000-memory.dmp
memory/2224-4-0x000000013FC20000-0x0000000142190000-memory.dmp
memory/2224-5-0x0000000077670000-0x0000000077672000-memory.dmp
memory/2224-7-0x00000000774C0000-0x0000000077669000-memory.dmp
memory/2224-10-0x00000000774C0000-0x0000000077669000-memory.dmp
memory/2224-15-0x000000013FC20000-0x0000000142190000-memory.dmp
memory/2476-33-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-46-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-55-0x0000000000480000-0x00000000004A0000-memory.dmp
memory/2476-54-0x0000000000480000-0x00000000004A0000-memory.dmp
memory/2476-53-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-52-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-51-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-50-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-48-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-45-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-34-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-35-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-36-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-37-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-38-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-39-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-40-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-41-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-43-0x0000000140000000-0x0000000140840000-memory.dmp
memory/2476-44-0x0000000000140000-0x0000000000160000-memory.dmp
memory/2496-47-0x000000013F770000-0x0000000141CE0000-memory.dmp
memory/2496-19-0x000000013F770000-0x0000000141CE0000-memory.dmp
memory/2496-21-0x0000000077670000-0x0000000077672000-memory.dmp
memory/2496-49-0x00000000774C0000-0x0000000077669000-memory.dmp
memory/2496-23-0x00000000774C0000-0x0000000077669000-memory.dmp
memory/2536-31-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2536-29-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2536-28-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2536-27-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2536-26-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2536-25-0x0000000140000000-0x000000014000E000-memory.dmp