Analysis
-
max time kernel
158s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 07:58
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240412-en
General
-
Target
tmp.exe
-
Size
10.7MB
-
MD5
b091c4848287be6601d720997394d453
-
SHA1
9180e34175e1f4644d5fa63227d665b2be15c75b
-
SHA256
d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
-
SHA512
a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
SSDEEP
196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral2/memory/4036-21-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-22-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-23-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-24-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-25-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-26-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-27-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-28-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-30-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-32-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-33-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-35-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-36-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-37-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-39-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/4036-40-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
dckuybanmlgp.exepid process 1792 dckuybanmlgp.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 1792 set thread context of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 set thread context of 4036 1792 dckuybanmlgp.exe svchost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2684 sc.exe 2088 sc.exe 3492 sc.exe 4404 sc.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
tmp.exedckuybanmlgp.exepid process 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 2276 tmp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe 1792 dckuybanmlgp.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeShutdownPrivilege 3832 powercfg.exe Token: SeCreatePagefilePrivilege 3832 powercfg.exe Token: SeShutdownPrivilege 3304 powercfg.exe Token: SeCreatePagefilePrivilege 3304 powercfg.exe Token: SeShutdownPrivilege 3928 powercfg.exe Token: SeCreatePagefilePrivilege 3928 powercfg.exe Token: SeShutdownPrivilege 4668 powercfg.exe Token: SeCreatePagefilePrivilege 4668 powercfg.exe Token: SeShutdownPrivilege 1900 powercfg.exe Token: SeCreatePagefilePrivilege 1900 powercfg.exe Token: SeShutdownPrivilege 1224 powercfg.exe Token: SeCreatePagefilePrivilege 1224 powercfg.exe Token: SeShutdownPrivilege 1416 powercfg.exe Token: SeCreatePagefilePrivilege 1416 powercfg.exe Token: SeShutdownPrivilege 4168 powercfg.exe Token: SeCreatePagefilePrivilege 4168 powercfg.exe Token: SeLockMemoryPrivilege 4036 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 1928 1792 dckuybanmlgp.exe conhost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe PID 1792 wrote to memory of 4036 1792 dckuybanmlgp.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3832 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3304 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
PID:2684 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
PID:2088 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:3492 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
PID:4404
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4168 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1928
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a