Overview

overview

10

Static

static

3

66944b456b...54.exe

windows7-x64

10

66944b456b...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe
  • Size 104KB
  • Sample240518-lt5fbaea6s
  • SHA256 66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xmrigevasionminerpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Windows security bypass 2 TTPs 24 IoCs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 10 IoCs
    miner
  • Downloads MZ/PE file
  • Executes dropped EXE 29 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 28 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe
        "C:\Users\Admin\AppData\Local\Temp\66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\sysblardsv.exe
          C:\Windows\sysblardsv.exe
          3⤵
          • Modifies security service
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Users\Admin\AppData\Local\Temp\292411612.exe
            C:\Users\Admin\AppData\Local\Temp\292411612.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2120
            • C:\Windows\syslmgrsvc.exe
              C:\Windows\syslmgrsvc.exe
              5⤵
              • Modifies security service
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: SetClipboardViewer
              • Suspicious use of WriteProcessMemory
              PID:1472
              • C:\Users\Admin\AppData\Local\Temp\1853227471.exe
                C:\Users\Admin\AppData\Local\Temp\1853227471.exe
                6⤵
                • Executes dropped EXE
                PID:3980
              • C:\Users\Admin\AppData\Local\Temp\1422819551.exe
                C:\Users\Admin\AppData\Local\Temp\1422819551.exe
                6⤵
                • Executes dropped EXE
                PID:2852
              • C:\Users\Admin\AppData\Local\Temp\3158811020.exe
                C:\Users\Admin\AppData\Local\Temp\3158811020.exe
                6⤵
                • Executes dropped EXE
                PID:3052
              • C:\Users\Admin\AppData\Local\Temp\297722235.exe
                C:\Users\Admin\AppData\Local\Temp\297722235.exe
                6⤵
                • Executes dropped EXE
                PID:2616
              • C:\Users\Admin\AppData\Local\Temp\3347826318.exe
                C:\Users\Admin\AppData\Local\Temp\3347826318.exe
                6⤵
                • Executes dropped EXE
                PID:2700
              • C:\Users\Admin\AppData\Local\Temp\2904817582.exe
                C:\Users\Admin\AppData\Local\Temp\2904817582.exe
                6⤵
                • Executes dropped EXE
                PID:2244
              • C:\Users\Admin\AppData\Local\Temp\906325439.exe
                C:\Users\Admin\AppData\Local\Temp\906325439.exe
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Windows directory
                PID:1660
                • C:\Users\Admin\syslmgrsvc.exe
                  C:\Users\Admin\syslmgrsvc.exe
                  7⤵
                  • Modifies security service
                  • Windows security bypass
                  • Executes dropped EXE
                  • Windows security modification
                  PID:2856
                  • C:\Users\Admin\AppData\Local\Temp\163487254.exe
                    C:\Users\Admin\AppData\Local\Temp\163487254.exe
                    8⤵
                    • Executes dropped EXE
                    PID:2412
                  • C:\Users\Admin\AppData\Local\Temp\1490933686.exe
                    C:\Users\Admin\AppData\Local\Temp\1490933686.exe
                    8⤵
                    • Executes dropped EXE
                    PID:4792
                  • C:\Users\Admin\AppData\Local\Temp\3226925155.exe
                    C:\Users\Admin\AppData\Local\Temp\3226925155.exe
                    8⤵
                    • Executes dropped EXE
                    PID:4560
          • C:\Users\Admin\AppData\Local\Temp\93693695.exe
            C:\Users\Admin\AppData\Local\Temp\93693695.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3264
            • C:\Windows\winqlsdrvcs.exe
              C:\Windows\winqlsdrvcs.exe
              5⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Suspicious use of WriteProcessMemory
              PID:2456
              • C:\Users\Admin\AppData\Local\Temp\2711618039.exe
                C:\Users\Admin\AppData\Local\Temp\2711618039.exe
                6⤵
                • Executes dropped EXE
                PID:5060
              • C:\Users\Admin\AppData\Local\Temp\3343512074.exe
                C:\Users\Admin\AppData\Local\Temp\3343512074.exe
                6⤵
                • Executes dropped EXE
                PID:2228
              • C:\Users\Admin\AppData\Local\Temp\1553934408.exe
                C:\Users\Admin\AppData\Local\Temp\1553934408.exe
                6⤵
                • Executes dropped EXE
                PID:2984
          • C:\Users\Admin\AppData\Local\Temp\1859427879.exe
            C:\Users\Admin\AppData\Local\Temp\1859427879.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3948
            • C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
              "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
              5⤵
              • Executes dropped EXE
              PID:3148
            • C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
              "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
              5⤵
              • Executes dropped EXE
              PID:4116
            • C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
              "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
              5⤵
              • Executes dropped EXE
              PID:2476
          • C:\Users\Admin\AppData\Local\Temp\1416519143.exe
            C:\Users\Admin\AppData\Local\Temp\1416519143.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4160
            • C:\Users\Admin\AppData\Local\Temp\2580212519.exe
              C:\Users\Admin\AppData\Local\Temp\2580212519.exe
              5⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:3872
          • C:\Users\Admin\AppData\Local\Temp\1234910357.exe
            C:\Users\Admin\AppData\Local\Temp\1234910357.exe
            4⤵
            • Executes dropped EXE
            PID:2856
          • C:\Users\Admin\AppData\Local\Temp\160551673.exe
            C:\Users\Admin\AppData\Local\Temp\160551673.exe
            4⤵
            • Executes dropped EXE
            PID:3284
          • C:\Users\Admin\AppData\Local\Temp\212105429.exe
            C:\Users\Admin\AppData\Local\Temp\212105429.exe
            4⤵
            • Executes dropped EXE
            PID:4828
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4828
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
        2⤵
          PID:2872
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3220
        • C:\Windows\System32\notepad.exe
          C:\Windows\System32\notepad.exe
          2⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1736
      • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
        "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5072

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
            • MD5 SHA1 SHA512
            Submit Download

            _3[1]
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CMMYN4JX\_3[1]
            • Size 9KB
            • SHA256 4831bd83c39ec9d898ccc1023858c81a03326b7c1c5dd8e24fdf9b2171707d1a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 3c2714ce07f8c04b3f8222dfe50d8ae08f548b0e6e79fe33d08bf6f4c2e5143e
            • MD5 SHA1 SHA512
            Submit Download

            1234910357.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1234910357.exe
            • Size 8KB
            • SHA256 dee9dca027009b7d2885ace7b968d2e9505a41b34756b08343338f8ef259e9be
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            1416519143.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1416519143.exe
            • Size 10KB
            • SHA256 e5d12658a690c62af7d4fc7b26735affc7210e3bfb6b2241de1bf90aebdc0717
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            1422819551.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1422819551.exe
            • Size 14KB
            • SHA256 b3395083c95e4e25611cb0e78be88790ea95b6e09f6d23298785fc4a0c08ce15
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            160551673.exe
            • Path C:\Users\Admin\AppData\Local\Temp\160551673.exe
            • Size 11KB
            • SHA256 e5162fa594811f0f01fc76f4acbd9fe99b2265df9cfcbc346023f28775c19f1e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            1853227471.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1853227471.exe
            • Size 93KB
            • SHA256 7c9759a8583dc85e94b2314931f713d665c8096c224cab2e162dc5045e26a3aa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            1859427879.exe
            • Path C:\Users\Admin\AppData\Local\Temp\1859427879.exe
            • Size 10KB
            • SHA256 e8a0c46342abd882318dbfdb17b7d3cb93d7138564878a15c5b91229ed81689c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            2580212519.exe
            • Path C:\Users\Admin\AppData\Local\Temp\2580212519.exe
            • Size 5.4MB
            • SHA256 dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            2711618039.exe
            • Path C:\Users\Admin\AppData\Local\Temp\2711618039.exe
            • Size 8KB
            • SHA256 8a169cf165f635ecb6c55cacecb2c202c5fc6ef5fa82ec9cdb7d4b0300f35293
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            292411612.exe
            • Path C:\Users\Admin\AppData\Local\Temp\292411612.exe
            • Size 93KB
            • SHA256 4b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            297722235.exe
            • Path C:\Users\Admin\AppData\Local\Temp\297722235.exe
            • Size 10KB
            • SHA256 8e45adf4b63d076d7cbf1066ec2b6168ec03ac78ce80b5531891fb380a90b4c1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            3158811020.exe
            • Path C:\Users\Admin\AppData\Local\Temp\3158811020.exe
            • Size 10KB
            • SHA256 1e337ed3d9d65d6f6cb626dc086166fcae0a7dc0f81ee8163444856a19973408
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            93693695.exe
            • Path C:\Users\Admin\AppData\Local\Temp\93693695.exe
            • Size 14KB
            • SHA256 483142a79ce1fce6474da5dcfeea48104eda46a960c7eb9b9581d555dd6cfc77
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Windows Security Upgrade Service.exe
            • Path C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
            • Size 20KB
            • SHA256 22be0689856c5e26d3b742120386b3895a3749e9a2e76d3b356eed2ea2df5f94
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            __PSScriptPolicyTest_jxowucsc.cgg.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxowucsc.cgg.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512
            Submit Download

            tbtcmds.dat
            • Path C:\Users\Admin\tbtcmds.dat
            • Size 287B
            • SHA256 ab7add8c38bc51dd1c8e76fad079db676923a6368e59459d24b9164c5a975496
            • MD5 SHA1 SHA512
            Submit Download

            tbtnds.dat
            • Path C:\Users\Admin\tbtnds.dat
            • Size 4KB
            • SHA256 5e5efb8c2371cd971d5a795f928d256bf7e62cf4a13e91ee5e9cb8a14c1072e7
            • MD5 SHA1 SHA512
            Submit Download

            tbtnds.dat
            • Path C:\Users\Admin\tbtnds.dat
            • Size 4KB
            • SHA256 1deca2ef7a6129efde85b3603015f3c9ed5acc95c8461a0aedcbf8a45c131a0c
            • MD5 SHA1 SHA512
            Submit Download

            tbtnds.dat
            • Path C:\Users\Admin\tbtnds.dat
            • Size 4KB
            • SHA256 89280f4437edd325d73398ddb865ec6467af77628fda5c90a78f019c5437f6a7
            • MD5 SHA1 SHA512
            Submit Download

            sysblardsv.exe
            • Path C:\Windows\sysblardsv.exe
            • Size 104KB
            • SHA256 66944b456b33438cbf93d112d973112903f57dc16bf4c069e968562fa8f01b54
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1736-163-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-185-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-186-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-187-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-188-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-149-0x000001D1334A0000-0x000001D1334C0000-memory.dmp
            Download

            memory/1736-202-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-213-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-221-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/1736-233-0x00007FF62A140000-0x00007FF62A92F000-memory.dmp
            Download

            memory/3872-122-0x00007FF798BC0000-0x00007FF799136000-memory.dmp
            Download

            memory/4828-113-0x00000227BB990000-0x00000227BB9B2000-memory.dmp
            Download

            memory/5072-148-0x00007FF7B83C0000-0x00007FF7B8936000-memory.dmp
            Download