Analysis
-
max time kernel
111s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 18:45
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240226-en
General
-
Target
tmp.exe
-
Size
10.7MB
-
MD5
b091c4848287be6601d720997394d453
-
SHA1
9180e34175e1f4644d5fa63227d665b2be15c75b
-
SHA256
d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
-
SHA512
a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
SSDEEP
196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2056-35-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-36-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-37-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-38-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-39-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-40-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-41-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-42-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-44-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-49-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-50-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-51-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-52-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-54-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-58-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2056-59-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
dckuybanmlgp.exedckuybanmlgp.exepid process 468 588 dckuybanmlgp.exe 1676 dckuybanmlgp.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 468 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 588 set thread context of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 set thread context of 2056 588 dckuybanmlgp.exe svchost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2360 sc.exe 2448 sc.exe 2136 sc.exe 2420 sc.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
tmp.exedckuybanmlgp.execonhost.exedckuybanmlgp.exepid process 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 2740 tmp.exe 588 dckuybanmlgp.exe 588 dckuybanmlgp.exe 588 dckuybanmlgp.exe 588 dckuybanmlgp.exe 588 dckuybanmlgp.exe 588 dckuybanmlgp.exe 588 dckuybanmlgp.exe 2828 conhost.exe 1676 dckuybanmlgp.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 468 -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeShutdownPrivilege 2232 powercfg.exe Token: SeShutdownPrivilege 2620 powercfg.exe Token: SeShutdownPrivilege 2856 powercfg.exe Token: SeShutdownPrivilege 2432 powercfg.exe Token: SeShutdownPrivilege 2780 powercfg.exe Token: SeShutdownPrivilege 2784 powercfg.exe Token: SeShutdownPrivilege 2804 powercfg.exe Token: SeShutdownPrivilege 2608 powercfg.exe Token: SeLockMemoryPrivilege 2056 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2828 588 dckuybanmlgp.exe conhost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe PID 588 wrote to memory of 2056 588 dckuybanmlgp.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2232 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
PID:2360 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
PID:2448 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2136 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
PID:2420
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2828 -
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a