Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-04-2024 01:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20240412-en
General
-
Target
tmp.exe
-
Size
10.7MB
-
MD5
b091c4848287be6601d720997394d453
-
SHA1
9180e34175e1f4644d5fa63227d665b2be15c75b
-
SHA256
d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
-
SHA512
a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a
-
SSDEEP
196608:oPnV1Bk/fRaGxUCBIORz5Z2YoZX0tMmp6tgq1D//XxdgPxwdT:oPKfR/UCBF+dZX0tMft/vxdgpG
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2852-35-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-36-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-37-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-38-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-39-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-40-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-41-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-42-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-44-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-48-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-50-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-51-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-49-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-52-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-53-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2852-54-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
dckuybanmlgp.exepid process 480 2504 dckuybanmlgp.exe -
Loads dropped DLL 1 IoCs
Processes:
pid process 480 -
Suspicious use of SetThreadContext 2 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 2504 set thread context of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 set thread context of 2852 2504 dckuybanmlgp.exe svchost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2744 sc.exe 2780 sc.exe 2708 sc.exe 2416 sc.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
tmp.exedckuybanmlgp.exepid process 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2292 tmp.exe 2504 dckuybanmlgp.exe 2504 dckuybanmlgp.exe 2504 dckuybanmlgp.exe 2504 dckuybanmlgp.exe 2504 dckuybanmlgp.exe 2504 dckuybanmlgp.exe 2504 dckuybanmlgp.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exedescription pid process Token: SeShutdownPrivilege 2592 powercfg.exe Token: SeShutdownPrivilege 2672 powercfg.exe Token: SeShutdownPrivilege 2588 powercfg.exe Token: SeShutdownPrivilege 2496 powercfg.exe Token: SeShutdownPrivilege 2868 powercfg.exe Token: SeShutdownPrivilege 2112 powercfg.exe Token: SeShutdownPrivilege 2668 powercfg.exe Token: SeShutdownPrivilege 2864 powercfg.exe Token: SeLockMemoryPrivilege 2852 svchost.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
dckuybanmlgp.exedescription pid process target process PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 1580 2504 dckuybanmlgp.exe conhost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe PID 2504 wrote to memory of 2852 2504 dckuybanmlgp.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2592 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "OBGPQMHF"2⤵
- Launches sc.exe
PID:2780 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "OBGPQMHF" binpath= "C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe" start= "auto"2⤵
- Launches sc.exe
PID:2708 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
PID:2744 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "OBGPQMHF"2⤵
- Launches sc.exe
PID:2416
-
C:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exeC:\ProgramData\ndfbaljqaqzm\dckuybanmlgp.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2668 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:1580
-
C:\Windows\system32\svchost.exesvchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.7MB
MD5b091c4848287be6601d720997394d453
SHA19180e34175e1f4644d5fa63227d665b2be15c75b
SHA256d0b06ca6ece3fef6671fa8acd3d560a9400891abcd10f5cedcfe7bd1e6050dfe
SHA512a3b3663fd343389aee2cbf76f426401d436992b2b56cea3b60e9c2e385510fa874fa45b2ac75703074f0303934c4223eaee1983851374a2e753fd0302042cc5a