Malware Analysis Report

2024-07-28 17:46

Sample ID 240613-rpks1awhkk
Target 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe
SHA256 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83
Tags
xmrig evasion miner
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83

Threat Level: Known bad

The file 01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe was found to be: Known bad.

Malicious Activity Summary

xmrig evasion miner

xmrig

XMRig Miner payload

Sets file to hidden

Modifies Windows Firewall

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Launches sc.exe

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Defense Evasion
TA0005
Impair Defenses
T1562
Disable or Modify System Firewall
T1562.004
Hide Artifacts
T1564
Hidden Files and Directories
T1564.001
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-13 14:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 14:22

Reported

2024-06-13 14:24

Platform

win7-20240611-en

Max time kernel

144s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\WINDOWS\Debug\c3p\svchost.exe N/A
N/A N/A C:\WINDOWS\Debug\c3p\svchost.exe N/A
N/A N/A C:\WINDOWS\Debug\c3p\systems.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\WINDOWS\Debug\c3p\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\debug\c3p C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\cmd.bat C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\svchost.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\systems.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p C:\Windows\SysWOW64\attrib.exe N/A
File created C:\WINDOWS\Debug\c3p\config.json C:\WINDOWS\Debug\c3p\systems.exe N/A
File opened for modification C:\Windows\debug\c3p\config.json C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\SHA256SUMS C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\SHA256SUMS C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\systems.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\WinRing0x64.sys C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\systems.exe C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Windows\debug\c3p\__tmp_rar_sfx_access_check_259417089 C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\cmd.bat C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\config.json C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\config.json C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Windows\debug\c3p\svchost.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\WinRing0x64.sys C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\svchost.exe C:\Windows\SysWOW64\attrib.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\WINDOWS\Debug\c3p\systems.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\WINDOWS\Debug\c3p\systems.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 1704 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2688 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2832 wrote to memory of 2720 N/A C:\WINDOWS\Debug\c3p\svchost.exe C:\WINDOWS\Debug\c3p\systems.exe
PID 2832 wrote to memory of 2720 N/A C:\WINDOWS\Debug\c3p\svchost.exe C:\WINDOWS\Debug\c3p\systems.exe
PID 2832 wrote to memory of 2720 N/A C:\WINDOWS\Debug\c3p\svchost.exe C:\WINDOWS\Debug\c3p\systems.exe
PID 2832 wrote to memory of 2720 N/A C:\WINDOWS\Debug\c3p\svchost.exe C:\WINDOWS\Debug\c3p\systems.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2520 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2576 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2576 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2576 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 2576 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

"C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Windows\debug\c3p\cmd.bat" "

C:\WINDOWS\Debug\c3p\svchost.exe

C:\WINDOWS\Debug\c3p\svchost.exe install "Networks2" C:\WINDOWS\Debug\c3p\systems.exe

C:\Windows\SysWOW64\sc.exe

sc config "Networks2" DisplayName= "Networksrs2"

C:\Windows\SysWOW64\sc.exe

sc description "Networks2" "Microsoft Windows Networks"

C:\Windows\SysWOW64\sc.exe

sc start "Networks2"

C:\WINDOWS\Debug\c3p\svchost.exe

C:\WINDOWS\Debug\c3p\svchost.exe

C:\Windows\SysWOW64\attrib.exe

attrib C:\Windows\debug\c3p +h +a

C:\Windows\SysWOW64\attrib.exe

attrib C:\Windows\debug\c3p\*.json +h +a +s +r

C:\WINDOWS\Debug\c3p\systems.exe

"C:\WINDOWS\Debug\c3p\systems.exe"

C:\Windows\SysWOW64\attrib.exe

attrib C:\Windows\debug\c3p\*.exe +h +a +s +r

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow

Network

Country Destination Domain Proto
US 8.8.8.8:53 auto.c3pool.org udp
DE 195.201.97.156:443 auto.c3pool.org tcp

Files

C:\Windows\debug\c3p\cmd.bat

MD5 6585c3073cfc45a3bdd30ed7521e84a0
SHA1 5196abc0728f1a14e554faf155fc3b31c1f57257
SHA256 da2faa5eb4171dd5272402dab13e882445a9e8f114defea3caabd2ad841e24f4
SHA512 fa11518e7e258d2a980d07f3e9c03eb1bf9b6a7413f62e2da3977046ad5fcb2bb05bd55ed83512a3027d9d07b5a884f0bccd16742f9c9fd6891ace98f80dd849

\Windows\debug\c3p\svchost.exe

MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

\Windows\debug\c3p\systems.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

C:\Windows\debug\c3p\config.json

MD5 ba73071a3d8a7fe866d174aa256d1c3e
SHA1 0a38fd8a8b287d44b4964e862ab241872e036115
SHA256 ee17b3a37459ed492847d2dc003f4904dcbf0d1579416474ac8c7b07ca96b81c
SHA512 ccc9b11406e893cdc6f2563e0c7e00a488d1685e2d58e6324b2680faffa40cb47cf9a8eab4cd77b1c67a85aa9ffd4811a21f84954f0f7345a0a477082106348d

memory/2720-34-0x00000000000F0000-0x0000000000110000-memory.dmp

memory/2720-36-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-37-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-38-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-39-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-40-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-41-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-42-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-43-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-44-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-45-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-46-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-47-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-48-0x000000013FA20000-0x0000000140523000-memory.dmp

memory/2720-49-0x000000013FA20000-0x0000000140523000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 14:22

Reported

2024-06-13 14:24

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\WINDOWS\Debug\c3p\svchost.exe N/A
N/A N/A C:\WINDOWS\Debug\c3p\svchost.exe N/A
N/A N/A C:\WINDOWS\Debug\c3p\systems.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\debug\c3p\__tmp_rar_sfx_access_check_240596968 C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\svchost.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\systems.exe C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Windows\debug\c3p C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\config.json C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\SHA256SUMS C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p C:\Windows\SysWOW64\attrib.exe N/A
File opened for modification C:\Windows\debug\c3p\cmd.bat C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\config.json C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\svchost.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\WINDOWS\Debug\c3p\config.json C:\WINDOWS\Debug\c3p\systems.exe N/A
File opened for modification C:\Windows\debug\c3p\svchost.exe C:\Windows\SysWOW64\attrib.exe N/A
File created C:\Windows\debug\c3p\cmd.bat C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\SHA256SUMS C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\systems.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\systems.exe C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File created C:\Windows\debug\c3p\WinRing0x64.sys C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\WinRing0x64.sys C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe N/A
File opened for modification C:\Windows\debug\c3p\config.json C:\Windows\SysWOW64\attrib.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\WINDOWS\Debug\c3p\systems.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\WINDOWS\Debug\c3p\systems.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2192 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 2192 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe C:\Windows\SysWOW64\cmd.exe
PID 3640 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 3640 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 3640 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\WINDOWS\Debug\c3p\svchost.exe
PID 3640 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 2136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 1604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 1760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3640 wrote to memory of 3420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 3420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 3420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 2884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3640 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3640 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3640 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 3696 wrote to memory of 3788 N/A C:\WINDOWS\Debug\c3p\svchost.exe C:\WINDOWS\Debug\c3p\systems.exe
PID 3696 wrote to memory of 3788 N/A C:\WINDOWS\Debug\c3p\svchost.exe C:\WINDOWS\Debug\c3p\systems.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe

"C:\Users\Admin\AppData\Local\Temp\01a976b80253450a09d0b89075f5fa923a3411265f7bc8f3413d059fd662aa83.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\debug\c3p\cmd.bat" "

C:\WINDOWS\Debug\c3p\svchost.exe

C:\WINDOWS\Debug\c3p\svchost.exe install "Networks2" C:\WINDOWS\Debug\c3p\systems.exe

C:\Windows\SysWOW64\sc.exe

sc config "Networks2" DisplayName= "Networksrs2"

C:\Windows\SysWOW64\sc.exe

sc description "Networks2" "Microsoft Windows Networks"

C:\Windows\SysWOW64\sc.exe

sc start "Networks2"

C:\WINDOWS\Debug\c3p\svchost.exe

C:\WINDOWS\Debug\c3p\svchost.exe

C:\Windows\SysWOW64\attrib.exe

attrib C:\Windows\debug\c3p +h +a

C:\Windows\SysWOW64\attrib.exe

attrib C:\Windows\debug\c3p\*.json +h +a +s +r

C:\Windows\SysWOW64\attrib.exe

attrib C:\Windows\debug\c3p\*.exe +h +a +s +r

C:\Windows\SysWOW64\netsh.exe

netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow

C:\WINDOWS\Debug\c3p\systems.exe

"C:\WINDOWS\Debug\c3p\systems.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 auto.c3pool.org udp
DE 159.69.83.232:443 auto.c3pool.org tcp
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.83.69.159.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
BE 2.17.107.105:443 www.bing.com tcp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 105.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp

Files

C:\Windows\debug\c3p\cmd.bat

MD5 6585c3073cfc45a3bdd30ed7521e84a0
SHA1 5196abc0728f1a14e554faf155fc3b31c1f57257
SHA256 da2faa5eb4171dd5272402dab13e882445a9e8f114defea3caabd2ad841e24f4
SHA512 fa11518e7e258d2a980d07f3e9c03eb1bf9b6a7413f62e2da3977046ad5fcb2bb05bd55ed83512a3027d9d07b5a884f0bccd16742f9c9fd6891ace98f80dd849

C:\Windows\debug\c3p\svchost.exe

MD5 d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1 e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA512 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

C:\Windows\debug\c3p\config.json

MD5 ba73071a3d8a7fe866d174aa256d1c3e
SHA1 0a38fd8a8b287d44b4964e862ab241872e036115
SHA256 ee17b3a37459ed492847d2dc003f4904dcbf0d1579416474ac8c7b07ca96b81c
SHA512 ccc9b11406e893cdc6f2563e0c7e00a488d1685e2d58e6324b2680faffa40cb47cf9a8eab4cd77b1c67a85aa9ffd4811a21f84954f0f7345a0a477082106348d

C:\Windows\debug\c3p\systems.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/3788-22-0x000001F3CA880000-0x000001F3CA8A0000-memory.dmp

memory/3788-23-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-24-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-25-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-26-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-27-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-28-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-29-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-30-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-31-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-32-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-33-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-34-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-35-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp

memory/3788-36-0x00007FF61C4A0000-0x00007FF61CFA3000-memory.dmp