Analysis
- max time kernel
20s - max time network
24s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
02/03/2024, 15:37
General
- Target AI WF GOOGLE.exe
- Size 17.9MB
- Sample240302-s2q18aef41
- SHA256 5dc5de381947ec24c3c3fcec600c354299ee50265c7ce66daf95a1f12d1d86f3
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 14 IoCs
- Creates new service(s) 1 TTPs
- Stops running service(s) 3 TTPs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 37 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 30 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AI WF GOOGLE.exe"C:\Users\Admin\AppData\Local\Temp\AI WF GOOGLE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dckuybanmlgp.exe
dckuybanmlgp.exe
memory/520-6-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-15-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-5-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-16-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-10-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-11-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-12-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-13-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-14-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/520-4-0x000002DE1C9B0000-0x000002DE1C9B1000-memory.dmp
memory/1448-0-0x00007FFE01BB0000-0x00007FFE01BB2000-memory.dmp
memory/1448-18-0x00007FF7AE650000-0x00007FF7B0BC0000-memory.dmp
memory/1448-1-0x00007FF7AE650000-0x00007FF7B0BC0000-memory.dmp
memory/1448-2-0x00007FF7AE650000-0x00007FF7B0BC0000-memory.dmp
memory/1592-21-0x00007FFE01BB0000-0x00007FFE01BB2000-memory.dmp
memory/1592-23-0x00007FF771B90000-0x00007FF774100000-memory.dmp
memory/1592-22-0x00007FF771B90000-0x00007FF774100000-memory.dmp
memory/1592-46-0x00007FF771B90000-0x00007FF774100000-memory.dmp
memory/2680-26-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2680-27-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2680-28-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2680-29-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2680-32-0x0000000140000000-0x000000014000E000-memory.dmp
memory/2680-25-0x0000000140000000-0x000000014000E000-memory.dmp
memory/3340-34-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-44-0x0000015BC55C0000-0x0000015BC55E0000-memory.dmp
memory/3340-37-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-36-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-38-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-39-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-40-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-41-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-43-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-35-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-33-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-45-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-47-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-48-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-49-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-50-0x0000000140000000-0x0000000140840000-memory.dmp
memory/3340-51-0x0000015BC5D60000-0x0000015BC5D80000-memory.dmp