Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 03:15
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240412-en
General
-
Target
tmp.exe
-
Size
10.7MB
-
MD5
b091c4848287be6601d720997394d453
-
SHA1
9180e34175e1f4644d5fa63227d665b2be15c75b
-
SHA256
d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
-
SHA512
a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
SSDEEP
196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2972-36-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-37-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-38-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-39-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-40-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-41-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-42-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-43-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-45-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-48-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-49-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-52-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-51-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-53-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-54-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2972-55-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
dckuybanmlgp.exepid process 476 2624 dckuybanmlgp.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 476 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 2624 set thread context of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 set thread context of 2972 2624 dckuybanmlgp.exe svchost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2716 sc.exe 2144 sc.exe 2760 sc.exe 2668 sc.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
tmp.exedckuybanmlgp.exepid process 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2204 tmp.exe 2624 dckuybanmlgp.exe 2624 dckuybanmlgp.exe 2624 dckuybanmlgp.exe 2624 dckuybanmlgp.exe 2624 dckuybanmlgp.exe 2624 dckuybanmlgp.exe 2624 dckuybanmlgp.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeShutdownPrivilege 2628 powercfg.exe Token: SeShutdownPrivilege 2644 powercfg.exe Token: SeShutdownPrivilege 2596 powercfg.exe Token: SeShutdownPrivilege 2124 powercfg.exe Token: SeShutdownPrivilege 1840 powercfg.exe Token: SeShutdownPrivilege 3052 powercfg.exe Token: SeShutdownPrivilege 2980 powercfg.exe Token: SeShutdownPrivilege 2736 powercfg.exe Token: SeLockMemoryPrivilege 2972 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 804 2624 dckuybanmlgp.exe conhost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe PID 2624 wrote to memory of 2972 2624 dckuybanmlgp.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeFilesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
memory/804-27-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/804-33-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/804-31-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/804-30-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/804-29-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/804-28-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2204-8-0x0000000077070000-0x0000000077219000-memory.dmpFilesize
1.7MB
-
memory/2204-16-0x0000000077070000-0x0000000077219000-memory.dmpFilesize
1.7MB
-
memory/2204-15-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2204-6-0x0000000077220000-0x0000000077222000-memory.dmpFilesize
8KB
-
memory/2204-2-0x0000000077220000-0x0000000077222000-memory.dmpFilesize
8KB
-
memory/2204-3-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2204-0-0x0000000077220000-0x0000000077222000-memory.dmpFilesize
8KB
-
memory/2624-19-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2624-22-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2624-24-0x0000000077070000-0x0000000077219000-memory.dmpFilesize
1.7MB
-
memory/2624-46-0x0000000077070000-0x0000000077219000-memory.dmpFilesize
1.7MB
-
memory/2624-50-0x0000000140000000-0x0000000141A14000-memory.dmpFilesize
26.1MB
-
memory/2972-36-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-45-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-39-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-40-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-41-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-42-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-43-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-37-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-47-0x0000000000140000-0x0000000000160000-memory.dmpFilesize
128KB
-
memory/2972-38-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-48-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-35-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-49-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-52-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-51-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-53-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-54-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-55-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2972-56-0x00000000001B0000-0x00000000001D0000-memory.dmpFilesize
128KB
-
memory/2972-57-0x00000000001B0000-0x00000000001D0000-memory.dmpFilesize
128KB