xmrig | 40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
Size 3.1MB
Sample240612-v91lqsxdpp
SHA256 40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779
MD5 2f03ead3988fc2b5e16470ed0a96557d
SHA1 4d0dcb7ebb340af8887fdec5f665eb091db9caf6
SHA512 799830b418d6bf37a4d7bcd9649ee6d2f0551101029fecb5e44e8115fd7e29daabd8e662e316565bd6e1e36aaf9c26a82c49c7bd65e7eb28a73e9c3930c90ca6
SSDEEP 49152:ByTeFwtj0HLirwzPPk/iZuKsZxof6SD3nlOyT3Pwsu8/Cf6PyBXEjk1:ByVEer3/iQZxofZXlOaN/Cf66NEa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner persistence vmprotect

Malware Config

Signatures

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023419-49.dat	family_xmrig
behavioral2/files/0x0007000000023419-49.dat	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation	w.exe

Executes dropped EXE 5 IoCs

pid	Process
4884	w.exe
4672	csrss.exe
4868	csrss.exe
212	svchost.exe
4048	chrome.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023413-39.dat	vmprotect
behavioral2/memory/212-41-0x0000000000400000-0x000000000055E000-memory.dmp	vmprotect
behavioral2/memory/212-42-0x0000000000400000-0x000000000055E000-memory.dmp	vmprotect
behavioral2/memory/212-55-0x0000000000400000-0x000000000055E000-memory.dmp	vmprotect

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\systam33\w.bat	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File created	C:\Windows\Fonts\systam33\svchost.ini	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File created	C:\Windows\Fonts\systam33\w.exe	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File opened for modification	C:\Windows\Fonts\systam33\svchost.log	svchost.exe
File created	C:\Windows\Fonts\systam33\1.ini	cmd.exe
File created	C:\Windows\Fonts\systam33\svchost.exe	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File created	C:\Windows\Fonts\chrome\config.json	w.exe
File opened for modification	C:\Windows\Fonts\chrome\config.json	w.exe
File created	C:\Windows\Fonts\chrome\chrome.exe	w.exe
File created	C:\Windows\Fonts\systam33\csrss.exe	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File opened for modification	C:\Windows\Fonts\systam33\svchost.exe	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File opened for modification	C:\Windows\Fonts\chrome\chrome.exe	w.exe
File created	C:\Windows\Fonts\chrome\WinRing0x64.sys	w.exe
File opened for modification	C:\Windows\Fonts\chrome\WinRing0x64.sys	w.exe
File opened for modification	C:\Windows\Fonts\systam33\w.bat	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File opened for modification	C:\Windows\Fonts\systam33\svchost.ini	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File opened for modification	C:\Windows\Fonts\systam33\csrss.exe	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File opened for modification	C:\Windows\Fonts\systam33\w.exe	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
File created	C:\Windows\Fonts\chrome\xmrig-asm.lib	w.exe
File opened for modification	C:\Windows\Fonts\chrome\xmrig-asm.lib	w.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4552	sc.exe
3452	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
2040	PING.EXE
2740	PING.EXE
3608	PING.EXE
3392	PING.EXE
3980	PING.EXE
4308	PING.EXE
1620	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
Token: SeIncBasePriorityPrivilege	4884	w.exe
Token: SeLockMemoryPrivilege	4048	chrome.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4048	chrome.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4884	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	84
PID 4676 wrote to memory of 4884	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	84
PID 4676 wrote to memory of 4884	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	84
PID 4676 wrote to memory of 2800	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	85
PID 4676 wrote to memory of 2800	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	85
PID 4676 wrote to memory of 2800	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	85
PID 4676 wrote to memory of 2156	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	87
PID 4676 wrote to memory of 2156	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	87
PID 4676 wrote to memory of 2156	4676	40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe	87
PID 2800 wrote to memory of 1276	2800	cmd.exe	89
PID 2800 wrote to memory of 1276	2800	cmd.exe	89
PID 2800 wrote to memory of 1276	2800	cmd.exe	89
PID 4884 wrote to memory of 1512	4884	w.exe	90
PID 4884 wrote to memory of 1512	4884	w.exe	90
PID 4884 wrote to memory of 1512	4884	w.exe	90
PID 2800 wrote to memory of 2740	2800	cmd.exe	92
PID 2800 wrote to memory of 2740	2800	cmd.exe	92
PID 2800 wrote to memory of 2740	2800	cmd.exe	92
PID 2156 wrote to memory of 3608	2156	cmd.exe	93
PID 2156 wrote to memory of 3608	2156	cmd.exe	93
PID 2156 wrote to memory of 3608	2156	cmd.exe	93
PID 1512 wrote to memory of 3392	1512	cmd.exe	94
PID 1512 wrote to memory of 3392	1512	cmd.exe	94
PID 1512 wrote to memory of 3392	1512	cmd.exe	94
PID 2800 wrote to memory of 4552	2800	cmd.exe	95
PID 2800 wrote to memory of 4552	2800	cmd.exe	95
PID 2800 wrote to memory of 4552	2800	cmd.exe	95
PID 2800 wrote to memory of 3980	2800	cmd.exe	96
PID 2800 wrote to memory of 3980	2800	cmd.exe	96
PID 2800 wrote to memory of 3980	2800	cmd.exe	96
PID 2800 wrote to memory of 4672	2800	cmd.exe	97
PID 2800 wrote to memory of 4672	2800	cmd.exe	97
PID 2800 wrote to memory of 4672	2800	cmd.exe	97
PID 2800 wrote to memory of 4308	2800	cmd.exe	98
PID 2800 wrote to memory of 4308	2800	cmd.exe	98
PID 2800 wrote to memory of 4308	2800	cmd.exe	98
PID 2800 wrote to memory of 4868	2800	cmd.exe	99
PID 2800 wrote to memory of 4868	2800	cmd.exe	99
PID 2800 wrote to memory of 4868	2800	cmd.exe	99
PID 2800 wrote to memory of 1620	2800	cmd.exe	100
PID 2800 wrote to memory of 1620	2800	cmd.exe	100
PID 2800 wrote to memory of 1620	2800	cmd.exe	100
PID 2800 wrote to memory of 3452	2800	cmd.exe	101
PID 2800 wrote to memory of 3452	2800	cmd.exe	101
PID 2800 wrote to memory of 3452	2800	cmd.exe	101
PID 2800 wrote to memory of 2040	2800	cmd.exe	104
PID 2800 wrote to memory of 2040	2800	cmd.exe	104
PID 2800 wrote to memory of 2040	2800	cmd.exe	104
PID 212 wrote to memory of 4048	212	svchost.exe	103
PID 212 wrote to memory of 4048	212	svchost.exe	103
PID 2800 wrote to memory of 3864	2800	cmd.exe	106
PID 2800 wrote to memory of 3864	2800	cmd.exe	106
PID 2800 wrote to memory of 3864	2800	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe
"C:\Users\Admin\AppData\Local\Temp\40331d6e3d18c61d5591aa85fc455f6674e78924ce4660ce18221aa49f696779.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\Fonts\systam33\w.exe
  "C:\Windows\Fonts\systam33\w.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~36CF.tmp.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:3392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systam33\w.bat" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\mode.com
    mode con: cols=16 lines=2
    3⤵
    PID:1276
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2740
- - C:\Windows\SysWOW64\sc.exe
    sc create UmRdpSerivce binPath= C:\Windows\Fonts\systam33\svchost.exe start= auto
    3⤵
    - Launches sc.exe
    PID:4552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3980
- - C:\Windows\Fonts\systam33\csrss.exe
    csrss set UmRdpSerivce DisplayName "Remote Desktop Services UserMode Port Redriector"
    3⤵
    - Executes dropped EXE
    PID:4672
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4308
- - C:\Windows\Fonts\systam33\csrss.exe
    csrss set UmRdpSerivce Description "Allows the redirection of Printers/Drives/Ports for RDP connectoins"
    3⤵
    - Executes dropped EXE
    PID:4868
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1620
- - C:\Windows\SysWOW64\sc.exe
    sc start UmRdpSerivce
    3⤵
    - Launches sc.exe
    PID:3452
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2040
- - C:\Windows\SysWOW64\regini.exe
    regini 1.ini
    3⤵
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~35F4.tmp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3608

C:\Windows\Fonts\systam33\svchost.exe
C:\Windows\Fonts\systam33\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\Fonts\chrome\chrome.exe
  C:\Windows\Fonts\chrome\chrome.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HZ~35F4.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\HZ~35F4.tmp.bat
Size 266B
SHA256 a48bcdb7a59fce333ddcd1e33e6547df049231ad42f032440aaa51075f9ac943
MD5 515c5ab1bba53eb7acbf281eba8374e0
SHA1 6765a6f12b36bdd914aab7b093b8738d7288d4e0
SHA512 cc7416c518866fa1969f22ccdcae7658ab3c6a6de424829565937b41f455338d7e13c401131ff2611e8d8af4d5c26994ed6a81896f62dd2c995cde8824045ffa
MD5 SHA1 SHA512

Submit Download

HZ~36CF.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\HZ~36CF.tmp.bat
Size 124B
SHA256 4150d0db0898ea43c5ac912fa94dc8567783755d3252bd28e3d40c5de4758851
MD5 9e8e1faaaf54789725159a1e527e8a15
SHA1 edec5b0de9a98b93106d8e951b323007d6b62726
SHA512 723c6751215188cfd81d57d873522b56724a0a6c7fdfe38c730a648a43b98db024bcd482de224b5d4201188f91d264bb4dacc653fdea2d1a3f0a8dc11e979b81
MD5 SHA1 SHA512

Submit Download

chrome.exe

Path C:\Windows\Fonts\chrome\chrome.exe
Size 5.2MB
SHA256 f6be8784ea31ee34b36efe2cb5d68bfec8fa33ab1a550c6fccb63cf469fe1208
MD5 6b592d1cceaf329c68acaff75fb80be2
SHA1 ebf5f792c4672973d366b14715b828e9e6e18dac
SHA512 4d32d48c29487eea40e3decfe9cc05e40c356df46eca51ac4ccef0bbb31abfb441f592b3bbd491ef5748865637f4420ebfbb76ab5e3df221148e8de8ba8f5138
SSDEEP 98304:Dy/06jlziidiyAdaBIafKTjnheIrEvZGtotFf84InSO1ptrJVyWHOu91rYg0:Dy/TViidi2ZGtOFfGSOXt9o4TrYF
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Windows\Fonts\chrome\config.json
Size 2KB
SHA256 f332695c2d7a40f634b93befbb479d854934cdf7d09bac8450382ea94c971239
MD5 3a2058068bc4a85ecd8edb7a7ebd3b09
SHA1 6f3ee264746612708e6cb1edd5b1e998bb9cfd5e
SHA512 39e18d39522a2db7e0c9db438e51901810efa20fb3d9125467e4025fff012024decf2601d2d9731b619d5f189715fcafff07f751c9e579fcfee3394897f5e3d3
MD5 SHA1 SHA512

Submit Download

1.ini

Path C:\Windows\Fonts\systam33\1.ini
Size 73B
SHA256 f093e254d918363e7f1e61b1f3b76692395f96d124fae1b77cb791e3a1a286bd
MD5 792c1d6adbc2d208c00b35e55d1d98d6
SHA1 dd15327dd92517b395d0873f1655e60097455a29
SHA512 c1ccaef5f5ff78a613d2dd1271af4427ad94797d3f9bf26f5a30637376435dfd7a51cc23844dc9ac6553b43775507d3b2def8b867f1a5305feb1ad0c4bfe1801
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\Windows\Fonts\systam33\csrss.exe
Size 286KB
SHA256 c67b6e6bde919aec414bc2176a77d6082758636e8d60d2ca83198a10d4cec9c7
MD5 b80172424d378e595b8ed4254ea7a492
SHA1 56d2049d50c38ff3e0fda94f0af5344c253abe35
SHA512 7de17c82076248e253335319970010b73e87ecb5c3ed00387a9d353edc31afbfcc58f09afbe3edacc1cef8b637d4d272cbf13d857135e7fbb364c0f3a7a9dd85
SSDEEP 6144:3u9himCezrVW9WpldFBsQlt76A7kYgXJ+mi+iPzWSHuwTiJa+ajLUoKFhNX:+9WUFBEXJ+wwTiJa+ajgbhNX
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\Fonts\systam33\svchost.exe
Size 684KB
SHA256 d55e4e16c8c60095c9897bea7db8fb71bf099008a3bc942a6062ffd5c0f05b27
MD5 cf7341a71cb0117e651fd1b4dc414657
SHA1 b34b4aa0f90fa9e02d4bd3fc64644b07d27876f4
SHA512 a161caafacaea87caada40b52753512ca83242e3c5a129793686843fdecb667e0fa5b92a384c260a7f11f38009fa787a39e8487628fb52bb81c1dd813c293859
SSDEEP 12288:Gl5aVGkl0vPi9Vd/2Hh0XBvQLW1xT6JnJoxJi8C1cgx57nlh8ACRlri0eHIY6zx:Kkyel2B0RikxTMnJoxJi8TGlh8ACvifD
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.ini

Path C:\Windows\Fonts\systam33\svchost.ini
Size 252B
SHA256 49fa9854a9283cf2f82d1a2e9be542ee438069542f3ab8acbb93e130968df463
MD5 62eb1b85bc112779e5bf0d380e92476d
SHA1 e32ecf8b742db94681b9dc6ad6bc7da966699fb2
SHA512 3a44c33a3793b29f0d060265e1e448b228b49f404a6dec88222798606da57063a7cf6f03bcc0aa93bd9c4e05d4b1e70da136a1eac901dd6e727837cfe4607df3
MD5 SHA1 SHA512

Submit Download

w.bat

Path C:\Windows\Fonts\systam33\w.bat
Size 531B
SHA256 d6f5b894cfb148c85f5176ddb7426d82c742769c38a0c5be29b93a1b9fdfce3b
MD5 48b7fb879283096712fca22f385750f1
SHA1 7ba4395c9a84f6df15fb38cbc325fed38ee3a75a
SHA512 fe3849c9139721978781bce2bb3fa97270f61df890ed79b6ecf4d7499351f12d474341dbcb89a9afb15bf54e081b79f06e34667832afee1377ec719a6326473b
MD5 SHA1 SHA512

Submit Download

w.exe

Path C:\Windows\Fonts\systam33\w.exe
Size 2.2MB
SHA256 8d3e6f50c5ec01cff2af94c635942daf3a55a43453639755acc1b5d27c51b6ab
MD5 e18bb32fccbca160f1e64777065a7f9c
SHA1 c94a7c7f6e74bbd25e6e3a2f20d1888de1d73c39
SHA512 8c4ec28de9443ae439b256afa108902ecf75a091d177be03abe059e75db597c3451917fd8f37f48e3024be5521678781a7029fce71ac367d1b8491a08ee3ca05
SSDEEP 49152:ByTeFwWB+O4tjXURGIPcVHH2gUvd50+JCez5VFVP19EpiIu:BylO4tQp0V2gepzLFRoiN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-41-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/212-42-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/212-55-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4048-51-0x00000179D74E0000-0x00000179D7500000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads