xmrig | d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d

General

Target
d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
Size 2.5MB
Sample240523-xtxw1sch73
SHA256 d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d
MD5 83449279b6b446d6fd06984afc83c143
SHA1 16f57f65a6131e3a6c7290aa9207ab89bd1ab8d0
SHA512 ec9723bb359d256e38f7bb1c2a4cefb8445c88b5476a569b7e4d0f3f53ac9e784d9df5e9d7a98aee3c7f2a0d677e97aa104f6a67b686a17336262f19cf9ead4c
SSDEEP 49152:dvegLj5rHfzEfDnk/Kg5W7OT5FLUYJMkVT59Hr7rEPI:d2ijJbSk/KSW7aQeMaT5x4g
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion execution miner

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x00070000000233ee-19.dat	family_xmrig
behavioral2/files/0x00070000000233ee-19.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4848	attrib.exe
4764	attrib.exe
1584	attrib.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe

Executes dropped EXE 4 IoCs

pid	Process
4904	lisks.exe
2588	lisks.exe
1812	lisks.exe
4616	wintsv.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wintsv\WinRing0x64.sys	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv\config.json	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv\lisks.exe	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv\wintsv.exe	attrib.exe
File opened for modification	C:\Windows\wintsv\config.json	attrib.exe
File created	C:\Windows\wintsv\WinRing0x64.sys	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File created	C:\Windows\wintsv\wintsv.exe	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv\wintsv.exe	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv\config.json	wintsv.exe
File opened for modification	C:\Windows\wintsv\lisks.exe	attrib.exe
File created	C:\Windows\wintsv\__tmp_rar_sfx_access_check_240604828	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File created	C:\Windows\wintsv\1.bat	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File created	C:\Windows\wintsv\config.json	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File created	C:\Windows\wintsv\lisks.exe	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
File opened for modification	C:\Windows\wintsv\1.bat	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3816	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4616	wintsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4616	wintsv.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 4856	1516	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe	82
PID 1516 wrote to memory of 4856	1516	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe	82
PID 1516 wrote to memory of 4856	1516	d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe	82
PID 4856 wrote to memory of 3816	4856	cmd.exe	85
PID 4856 wrote to memory of 3816	4856	cmd.exe	85
PID 4856 wrote to memory of 3816	4856	cmd.exe	85
PID 4856 wrote to memory of 4904	4856	cmd.exe	86
PID 4856 wrote to memory of 4904	4856	cmd.exe	86
PID 4856 wrote to memory of 2588	4856	cmd.exe	87
PID 4856 wrote to memory of 2588	4856	cmd.exe	87
PID 1812 wrote to memory of 4616	1812	lisks.exe	91
PID 1812 wrote to memory of 4616	1812	lisks.exe	91
PID 4856 wrote to memory of 4848	4856	cmd.exe	95
PID 4856 wrote to memory of 4848	4856	cmd.exe	95
PID 4856 wrote to memory of 4848	4856	cmd.exe	95
PID 4856 wrote to memory of 4764	4856	cmd.exe	96
PID 4856 wrote to memory of 4764	4856	cmd.exe	96
PID 4856 wrote to memory of 4764	4856	cmd.exe	96
PID 4856 wrote to memory of 1584	4856	cmd.exe	97
PID 4856 wrote to memory of 1584	4856	cmd.exe	97
PID 4856 wrote to memory of 1584	4856	cmd.exe	97

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4848	attrib.exe
4764	attrib.exe
1584	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe
"C:\Users\Admin\AppData\Local\Temp\d318387b2c562ae139b32d1fd003c827a01bb69d30153db932fccd0071e5757d.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\wintsv\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc delete wintsvds
    3⤵
    - Launches sc.exe
    PID:3816
- - C:\Windows\wintsv\lisks.exe
    C:\Windows\wintsv\lisks.exe install wintsvds wintsv.exe
    3⤵
    - Executes dropped EXE
    PID:4904
- - C:\Windows\wintsv\lisks.exe
    C:\Windows\wintsv\lisks.exe start wintsvds
    3⤵
    - Executes dropped EXE
    PID:2588
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\wintsv\wintsv.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4848
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\wintsv\lisks.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4764
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\wintsv\config.json
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1584

C:\Windows\wintsv\lisks.exe
C:\Windows\wintsv\lisks.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\wintsv\wintsv.exe
  "wintsv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Impair Defenses

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Windows\wintsv\1.bat
Size 290B
SHA256 00f8babfec70d09b3bb5f33f5b328e378d2309704edb2cbcc75e48f6c483e2a7
MD5 4487e2730447d3385df9d83d52eb75ff
SHA1 fb5c960c7fabe80f9b5945280e2b52f3600e6a8f
SHA512 1817a64678490854cfc88d3f3b821344428e56af0edfc5dd4fd0a552091f88dd5ee622b2e29b3aac02eaa480c7b25a5f1ff19db60dd6999b1ec3553fec33ff03
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Windows\wintsv\config.json
Size 3KB
SHA256 0f5ccc22a88cf427dc70396fbba580d45139608e977affc8881540007e01088b
MD5 0bc2df7b76e5923154c42f0ac268b3be
SHA1 1fb4166f2700361b02638be579a89053b47b40da
SHA512 451351c54a33dda86fb236d7edbdbded7d05f940d53818f98082fda1823f8db0de21546ce1d7093aee527047f1dccd8719489ef51489f4bff084a05677d0301d
MD5 SHA1 SHA512

Submit Download

lisks.exe

Path C:\Windows\wintsv\lisks.exe
Size 360KB
SHA256 eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848
MD5 1136efb1a46d1f2d508162387f30dc4d
SHA1 f280858dcfefabc1a9a006a57f6b266a5d1fde8e
SHA512 43b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5
SSDEEP 6144:0I6VyDGb+HiFr4kchE18dkuCj7jLwcYBQarDosNXJ:0IJDGb+Hiu9hE18dkxfdsNXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wintsv.exe

Path C:\Windows\wintsv\wintsv.exe
Size 6.2MB
SHA256 37fe1803c66d8b38c59978cf7fc8c9a2456d6135f572076804cb2ea92948c0da
MD5 c1beea88e68ff48d618e7db21c9951eb
SHA1 378c2550a7cb87af9995397265cd6db9e5c095d8
SHA512 e8e73db7733cf4248f1bc36bf790404d2b8d8d7813c5f5bdb947bb64fdd744f5b9ab08ab3aebc79dcd2535a778ab60145c427cd7605fba1b8850e863d677e86f
SSDEEP 98304:Q8tR/9SFGdVMmoDGs1M+HaLvEJxaALaDWikbQeAPTIOAXCaZUCIp+PWOh8q9tX/y:Qo4QdeAPTIOYClp+P1ZTX6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4616-21-0x0000023E530D0000-0x0000023E530F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads