xmrig | e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
Size 3.0MB
Sample240613-chabcsthjj
SHA256 e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0
MD5 f0834f7f2daa415fb992d93f549bbfd0
SHA1 6ed4d761bf163120bab0dd7ab578ee4ab8d5d80c
SHA512 2631b2e2ae6e1f53143bfd5f16027374c8e9fb85b04b145edbb1f4df5e0451ead6e61d5fccb1e6f950d06dff628168a6b97f030b25fa6c4abcabf6bfb2fb7c82
SSDEEP 49152:YKTiWztohDIZZYiOG2qPX4xRgPZcUAtijL+kOqxvDUuPBBVFJt6NGGTDVOXLyagx:YK+WJ6sDYI2qPX4fgPZcUAUjSkXvDUiC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner

Malware Config

Signatures

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023522-20.dat	family_xmrig
behavioral2/files/0x0007000000023522-20.dat	xmrig
behavioral2/memory/4504-23-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-24-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-25-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-26-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-27-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-28-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-29-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-30-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-31-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-32-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-33-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-34-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-35-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig
behavioral2/memory/4504-36-0x00007FF775E60000-0x00007FF776963000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4932	netsh.exe

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2284	attrib.exe
2040	attrib.exe
4512	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe

Executes dropped EXE 3 IoCs

pid	Process
4476	svchost.exe
4536	svchost.exe
4504	systems.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\debug\sky\config.json	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File created	C:\Windows\debug\sky\SHA256SUMS	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File created	C:\Windows\debug\sky\systems.exe	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File created	C:\Windows\debug\sky\WinRing0x64.sys	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky\WinRing0x64.sys	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky\config.json	attrib.exe
File opened for modification	C:\Windows\debug\sky	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File created	C:\Windows\debug\sky\svchost.exe	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky\svchost.exe	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File created	C:\Windows\debug\sky\cmd.bat	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File created	C:\WINDOWS\Debug\sky\config.json	systems.exe
File opened for modification	C:\Windows\debug\sky\cmd.bat	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky	attrib.exe
File opened for modification	C:\Windows\debug\sky\svchost.exe	attrib.exe
File opened for modification	C:\Windows\debug\sky\systems.exe	attrib.exe
File created	C:\Windows\debug\sky\__tmp_rar_sfx_access_check_240647718	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky\SHA256SUMS	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky\systems.exe	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
File opened for modification	C:\Windows\debug\sky\config.json	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1816	sc.exe
2232	sc.exe
2824	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4504	systems.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4504	systems.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 3208	832	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe	89
PID 832 wrote to memory of 3208	832	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe	89
PID 832 wrote to memory of 3208	832	e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe	89
PID 3208 wrote to memory of 4476	3208	cmd.exe	93
PID 3208 wrote to memory of 4476	3208	cmd.exe	93
PID 3208 wrote to memory of 4476	3208	cmd.exe	93
PID 3208 wrote to memory of 1816	3208	cmd.exe	95
PID 3208 wrote to memory of 1816	3208	cmd.exe	95
PID 3208 wrote to memory of 1816	3208	cmd.exe	95
PID 3208 wrote to memory of 2232	3208	cmd.exe	96
PID 3208 wrote to memory of 2232	3208	cmd.exe	96
PID 3208 wrote to memory of 2232	3208	cmd.exe	96
PID 3208 wrote to memory of 2824	3208	cmd.exe	97
PID 3208 wrote to memory of 2824	3208	cmd.exe	97
PID 3208 wrote to memory of 2824	3208	cmd.exe	97
PID 3208 wrote to memory of 2284	3208	cmd.exe	99
PID 3208 wrote to memory of 2284	3208	cmd.exe	99
PID 3208 wrote to memory of 2284	3208	cmd.exe	99
PID 3208 wrote to memory of 2040	3208	cmd.exe	100
PID 3208 wrote to memory of 2040	3208	cmd.exe	100
PID 3208 wrote to memory of 2040	3208	cmd.exe	100
PID 3208 wrote to memory of 4512	3208	cmd.exe	101
PID 3208 wrote to memory of 4512	3208	cmd.exe	101
PID 3208 wrote to memory of 4512	3208	cmd.exe	101
PID 3208 wrote to memory of 4932	3208	cmd.exe	103
PID 3208 wrote to memory of 4932	3208	cmd.exe	103
PID 3208 wrote to memory of 4932	3208	cmd.exe	103
PID 4536 wrote to memory of 4504	4536	svchost.exe	105
PID 4536 wrote to memory of 4504	4536	svchost.exe	105

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2284	attrib.exe
2040	attrib.exe
4512	attrib.exe

C:\Users\Admin\AppData\Local\Temp\e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe
"C:\Users\Admin\AppData\Local\Temp\e14d20d5a80507197245fc2b53eefc6c5b9de9a422857b376434f7dd03533bc0.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\sky\cmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\WINDOWS\Debug\sky\svchost.exe
    C:\WINDOWS\Debug\sky\svchost.exe install "Networks1" C:\WINDOWS\Debug\sky\systems.exe
    3⤵
    - Executes dropped EXE
    PID:4476
- - C:\Windows\SysWOW64\sc.exe
    sc config "Networks1" DisplayName= "Networksr1"
    3⤵
    - Launches sc.exe
    PID:1816
- - C:\Windows\SysWOW64\sc.exe
    sc description "Networks1" "Microsoft Windows Networks"
    3⤵
    - Launches sc.exe
    PID:2232
- - C:\Windows\SysWOW64\sc.exe
    sc start "Networks1"
    3⤵
    - Launches sc.exe
    PID:2824
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\sky +h +a
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2284
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\sky\*.json +h +a +s +r
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2040
- - C:\Windows\SysWOW64\attrib.exe
    attrib C:\Windows\debug\sky\*.exe +h +a +s +r
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4512
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:4932

C:\WINDOWS\Debug\sky\svchost.exe
C:\WINDOWS\Debug\sky\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536
- C:\WINDOWS\Debug\sky\systems.exe
  "C:\WINDOWS\Debug\sky\systems.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:3168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmd.bat

Path C:\Windows\debug\sky\cmd.bat
Size 477B
SHA256 12bad8309269711e27502d875b51a196d708788908c3d8299d351f600d945748
MD5 d3be305f5e1d520429bcef07b0ddace8
SHA1 4f0bb0819e9e6dbb58f2547985dc3eb909bcb451
SHA512 83e756a59b4180ba7e1c61b63ab885a68f5fe738f531ccd3c97906e61480eeadf081937654f2467433af3a6e8cac83c6c09899eb11f3893ffd6d0f5099028c00
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\Windows\debug\sky\config.json
Size 2KB
SHA256 207ca67a559b955766baacc91475ce28e4f313e8fc95903667cf23db21c269c7
MD5 2b24068503219a342c102ca0f4e095c5
SHA1 6095ded629014235bf286d983628ea583f154b90
SHA512 6b32feffebec1ed03fb3a596614290ac34cbe7e06baf75e8c7fbe7f7e34bc111623e565d934c6a5e13d9296f03991f53927dfafec89b3616bada7c3f896b5d87
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Windows\debug\sky\svchost.exe
Size 288KB
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
SSDEEP 6144:4BULviqYnI3QA7JTXRnZSHL2GZbkG/TZgLgst2rDkXNBD:wqBlG/TZgUsxXNBD
MD5 SHA1 SHA512 SSDEEP

Submit Download

systems.exe

Path C:\Windows\debug\sky\systems.exe
Size 7.9MB
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
SSDEEP 98304:/Ss0YJodntQk3Hv7I4a1Shua+XOoca2q4RVHNaAXMbmx4WH5umbLtb/IRHOhrgjY:LqQk3DBNfrkhKj4DbrxLskS3qAP2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4504-26-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-29-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-24-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-25-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-22-0x0000025597C90000-0x0000025597CB0000-memory.dmp

Download

memory/4504-27-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-28-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-23-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-30-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-31-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-32-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-33-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-34-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-35-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

memory/4504-36-0x00007FF775E60000-0x00007FF776963000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads