Analysis
-
max time kernel
113s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-03-2024 15:24
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240226-en
General
-
Target
tmp.exe
-
Size
10.4MB
-
MD5
dff762abefd2ac634f87aacd920c8bdc
-
SHA1
b8ea30c9d631fbb4a1f57c2873ca8aeb64c93643
-
SHA256
33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c
-
SHA512
54db97efb4ffcec9bc4122a6e41029c3cd457b631ede685eb883d5884f5a7b90c465dc8ec2212e712af935481073a2b4eb5180431926f03febccb055d9585341
-
SSDEEP
196608:D2neZjvDa5N5o9LrIbQTsbHu7THe8FhG8ryPzB3SFyFYha:D3/AU9LrIdb+THVFg8uhSYFYha
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2252-36-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-37-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-38-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-39-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-40-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-41-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-42-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-43-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-46-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-50-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-51-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-52-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-53-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-54-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-63-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2252-64-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
todymdgvwmgb.exetodymdgvwmgb.exepid process 464 2988 todymdgvwmgb.exe 1212 todymdgvwmgb.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 464 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
todymdgvwmgb.exedescription pid process target process PID 2988 set thread context of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 set thread context of 2252 2988 todymdgvwmgb.exe svchost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2740 sc.exe 2568 sc.exe 2452 sc.exe 2400 sc.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
tmp.exetodymdgvwmgb.execonhost.exetodymdgvwmgb.exepid process 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 1964 tmp.exe 2988 todymdgvwmgb.exe 2988 todymdgvwmgb.exe 2988 todymdgvwmgb.exe 2988 todymdgvwmgb.exe 2988 todymdgvwmgb.exe 2988 todymdgvwmgb.exe 2988 todymdgvwmgb.exe 2384 conhost.exe 1212 todymdgvwmgb.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeShutdownPrivilege 2616 powercfg.exe Token: SeShutdownPrivilege 2752 powercfg.exe Token: SeShutdownPrivilege 2628 powercfg.exe Token: SeShutdownPrivilege 2500 powercfg.exe Token: SeShutdownPrivilege 588 powercfg.exe Token: SeShutdownPrivilege 1112 powercfg.exe Token: SeShutdownPrivilege 1248 powercfg.exe Token: SeShutdownPrivilege 1440 powercfg.exe Token: SeLockMemoryPrivilege 2252 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
todymdgvwmgb.exedescription pid process target process PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2384 2988 todymdgvwmgb.exe conhost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe PID 2988 wrote to memory of 2252 2988 todymdgvwmgb.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2628 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "PHSWJLZY"2⤵
- Launches sc.exe
PID:2740 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "PHSWJLZY" binpath= "C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe" start= "auto"2⤵
- Launches sc.exe
PID:2568 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2452 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "PHSWJLZY"2⤵
- Launches sc.exe
PID:2400
-
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exeC:\ProgramData\jndraacsywhc\todymdgvwmgb.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:588 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1440 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384 -
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"C:\ProgramData\jndraacsywhc\todymdgvwmgb.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1212 -
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exeFilesize
4.4MB
MD5d5e74379dbb2b8b1ecb062295acbe01f
SHA18bb109bff5ed0b9254d12cb8c9a34998fc92dd77
SHA256e622fa3c9ced84da3fd17131438d8f6c357fa23858cbc44752e710d7a2d15c53
SHA512a4cc4513f2ab1373e837383b29c4cf2a2dd546c8482302dff89ea5319f4beb1736c515a15ad48999b9269827d6f2a81137e4199dbe276270073520700f8d575a
-
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exeFilesize
6.6MB
MD5e38e262ce5e1814d76d453c95ee3f03d
SHA1c9cce8d188a6d906db2e2a4918281a28e5fe9bec
SHA256952c2d2e3b48819b8fa1c8dc9cd7478b1dedb89e5ae40092b4d4d23fbb67e839
SHA512fcf61ee80f5b045206ac2d0c5f7b85f780b7fda5afe1b938e86f06ef700d009ac91c6c6db67c2c9a7c65b9439ef437c59f1f35ad2971b4b290c3949edf929359
-
C:\ProgramData\jndraacsywhc\todymdgvwmgb.exeFilesize
5.3MB
MD564a23104fa03e98c14bcb39b3876c3ed
SHA19470ab48cd54482012bb5df18492f0532404e0d3
SHA256fdc9ea28abf530eaa9614a5c885e5cc17dbcab576e00ffcf9b31d488856129d5
SHA5129694df45efa76d9fdc8e4d62a2c8acfc37a8b9b1a1217e976454c2cc2e7341dc392c32976c345a69160d2057ffd97c8d1acfb7fc7a7ce20f2776f4166d3240fd
-
\ProgramData\jndraacsywhc\todymdgvwmgb.exeFilesize
3.6MB
MD51e64937c425097f7e47e327e7f713c3b
SHA1fb3bb6564321ef74688d71be1037b45d45f75851
SHA2568835ceecae6f9204c6c3f09681a3dd3233c3e27e60c0bd73d73d6649f27837da
SHA512acf38a9aefcffff014d983426e074197fc11366c86f6f8ffbdc1995ade1fd90ed390caf3998454b7d0d0faf4f98d87559637e9d3a0a86e032b77e32089e4c98b
-
\ProgramData\jndraacsywhc\todymdgvwmgb.exeFilesize
3.7MB
MD51061d585214322a5b72c5543fa6d554e
SHA187e57f339b3781175bfae2b08b1a88d1da2e67c4
SHA256e40995e3d4d0312f99a960b61305c34b5f5ad1f436326bf1f2ab365b88b0a483
SHA512acebbd154a7df1c0e5fe5bbcca9d745cefe8ad0d848e42f639a9bcabc6b5c9bd5ca7ef48c5afe2206bee27b8617585e7d9c46903b875af45d439e59176c0a087
-
memory/1212-57-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/1212-61-0x0000000077550000-0x00000000776F9000-memory.dmpFilesize
1.7MB
-
memory/1964-8-0x0000000077550000-0x00000000776F9000-memory.dmpFilesize
1.7MB
-
memory/1964-12-0x0000000077550000-0x00000000776F9000-memory.dmpFilesize
1.7MB
-
memory/1964-10-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/1964-9-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/1964-0-0x0000000077700000-0x0000000077702000-memory.dmpFilesize
8KB
-
memory/1964-17-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/1964-4-0x0000000077700000-0x0000000077702000-memory.dmpFilesize
8KB
-
memory/1964-5-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/1964-2-0x0000000077700000-0x0000000077702000-memory.dmpFilesize
8KB
-
memory/2252-35-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-52-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-66-0x0000000000390000-0x00000000003B0000-memory.dmpFilesize
128KB
-
memory/2252-65-0x0000000000390000-0x00000000003B0000-memory.dmpFilesize
128KB
-
memory/2252-64-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-63-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-54-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-36-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-37-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-38-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-39-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-40-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-41-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-42-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-43-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-53-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-46-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-47-0x0000000000040000-0x0000000000060000-memory.dmpFilesize
128KB
-
memory/2252-51-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2252-50-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2384-28-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2384-27-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2384-33-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2384-31-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2384-30-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2384-29-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2988-49-0x0000000077550000-0x00000000776F9000-memory.dmpFilesize
1.7MB
-
memory/2988-48-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/2988-25-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB
-
memory/2988-24-0x0000000077550000-0x00000000776F9000-memory.dmpFilesize
1.7MB
-
memory/2988-23-0x0000000140000000-0x000000014199B000-memory.dmpFilesize
25.6MB