Analysis
-
max time kernel
382s -
max time network
374s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08-04-2024 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
123p.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
17 signatures
1800 seconds
General
-
Target
123p.exe
-
Size
10.7MB
-
MD5
b091c4848287be6601d720997394d453
-
SHA1
9180e34175e1f4644d5fa63227d665b2be15c75b
-
SHA256
d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
-
SHA512
a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
SSDEEP
196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-34-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-35-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-36-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-37-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-38-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-39-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-40-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-41-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-43-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-46-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-47-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-48-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-49-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-50-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-52-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2452-53-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
dckuybanmlgp.exepid Process 1548 dckuybanmlgp.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dckuybanmlgp.exedescription pid Process procid_target PID 1548 set thread context of 5080 1548 dckuybanmlgp.exe 123 PID 1548 set thread context of 2452 1548 dckuybanmlgp.exe 128 -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid Process 2812 sc.exe 4312 sc.exe 912 sc.exe 1528 sc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
123p.exetaskmgr.exedckuybanmlgp.exepid Process 2400 123p.exe 2400 123p.exe 3356 taskmgr.exe 3356 taskmgr.exe 2400 123p.exe 2400 123p.exe 2400 123p.exe 2400 123p.exe 2400 123p.exe 2400 123p.exe 2400 123p.exe 2400 123p.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 1548 dckuybanmlgp.exe 1548 dckuybanmlgp.exe 3356 taskmgr.exe 1548 dckuybanmlgp.exe 1548 dckuybanmlgp.exe 1548 dckuybanmlgp.exe 1548 dckuybanmlgp.exe 1548 dckuybanmlgp.exe 3356 taskmgr.exe 3356 taskmgr.exe 1548 dckuybanmlgp.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 3356 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid Process 664 -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
taskmgr.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid Process Token: SeDebugPrivilege 3356 taskmgr.exe Token: SeSystemProfilePrivilege 3356 taskmgr.exe Token: SeCreateGlobalPrivilege 3356 taskmgr.exe Token: SeShutdownPrivilege 2684 powercfg.exe Token: SeCreatePagefilePrivilege 2684 powercfg.exe Token: SeShutdownPrivilege 3128 powercfg.exe Token: SeCreatePagefilePrivilege 3128 powercfg.exe Token: SeShutdownPrivilege 4168 powercfg.exe Token: SeCreatePagefilePrivilege 4168 powercfg.exe Token: SeShutdownPrivilege 412 powercfg.exe Token: SeCreatePagefilePrivilege 412 powercfg.exe Token: SeShutdownPrivilege 1804 powercfg.exe Token: SeCreatePagefilePrivilege 1804 powercfg.exe Token: SeShutdownPrivilege 5016 powercfg.exe Token: SeCreatePagefilePrivilege 5016 powercfg.exe Token: SeShutdownPrivilege 3904 powercfg.exe Token: SeCreatePagefilePrivilege 3904 powercfg.exe Token: SeShutdownPrivilege 2860 powercfg.exe Token: SeCreatePagefilePrivilege 2860 powercfg.exe Token: SeLockMemoryPrivilege 2452 svchost.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe 3356 taskmgr.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dckuybanmlgp.exedescription pid Process procid_target PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 5080 1548 dckuybanmlgp.exe 123 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128 PID 1548 wrote to memory of 2452 1548 dckuybanmlgp.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\123p.exe"C:\Users\Admin\AppData\Local\Temp\123p.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2400 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3128
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
PID:912
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
PID:1528
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:4312
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
PID:2812
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3356
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:5080
-
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a