Overview
overview
10Static
static
1file01 - c...ia.ps1
windows7-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows7-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
3file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
3file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows7-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...9).ps1
windows7-x64
3file01 - c...9).ps1
windows10-1703-x64
10file01 - c...9).ps1
windows10-2004-x64
10file01 - c...9).ps1
windows11-21h2-x64
3Resubmissions
16/06/2024, 07:20 UTC
240616-h6f2psycpm 1016/06/2024, 07:20 UTC
240616-h6f2psvbka 1016/06/2024, 07:20 UTC
240616-h6f2psycpl 1016/06/2024, 07:20 UTC
240616-h6f2psycpk 1016/06/2024, 07:20 UTC
240616-h6f2psvbjh 1016/06/2024, 07:20 UTC
240616-h6fqyaycnr 1016/06/2024, 07:20 UTC
240616-h6fqyaycnq 1016/06/2024, 07:20 UTC
240616-h6fqyaycnp 1016/06/2024, 07:20 UTC
240616-h6fqyavbjg 1016/06/2024, 07:20 UTC
240616-h6fqyaycnn 10Analysis
-
max time kernel
1799s -
max time network
1792s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/06/2024, 07:20 UTC
Static task
static1
Behavioral task
behavioral1
Sample
file01 - copia (10) - copia.ps1
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
file01 - copia (10) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
file01 - copia (10) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
file01 - copia (10) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
file01 - copia (11) - copia.ps1
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
file01 - copia (11) - copia.ps1
Resource
win10-20240611-en
Behavioral task
behavioral7
Sample
file01 - copia (11) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
file01 - copia (11) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
file01 - copia (12) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
file01 - copia (12) - copia.ps1
Resource
win10-20240611-en
Behavioral task
behavioral11
Sample
file01 - copia (12) - copia.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
file01 - copia (12) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
file01 - copia (13) - copia.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
file01 - copia (13) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
file01 - copia (13) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
file01 - copia (13) - copia.ps1
Resource
win11-20240419-en
Behavioral task
behavioral17
Sample
file01 - copia (14) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
file01 - copia (14) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
file01 - copia (14) - copia.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
file01 - copia (14) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
file01 - copia (15) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
file01 - copia (15) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
file01 - copia (15) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
file01 - copia (15) - copia.ps1
Resource
win11-20240611-en
Behavioral task
behavioral25
Sample
file01 - copia (9) - copia.ps1
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
file01 - copia (9) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
file01 - copia (9) - copia.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
file01 - copia (9) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral29
Sample
file01 - copia (9).ps1
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
file01 - copia (9).ps1
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
file01 - copia (9).ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
file01 - copia (9).ps1
Resource
win11-20240508-en
General
-
Target
file01 - copia (12) - copia.ps1
-
Size
462B
-
MD5
5e2dca825bed214a14705357df13d8d6
-
SHA1
04f20b1094e5e905bcbcdfc0f1279f6a6e2bbb9e
-
SHA256
b45546367df23b2459a55ffa753ad4d66f8588263f87c339fb81cde87c3ffba4
-
SHA512
70a31874a475560704829224c71d6e9f01d6dc3bfe5b1f453ff817753f7a6d1ed51249481cd14e8adae497ad6ddfbe8b4e9556556886dd97c9587b24b0701501
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral12/files/0x000100000002aa34-39.dat family_xmrig behavioral12/files/0x000100000002aa34-39.dat xmrig behavioral12/memory/2328-48-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-52-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-54-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-55-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-58-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-59-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-60-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-61-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-62-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-63-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-64-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-65-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-66-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-67-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-68-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-69-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-70-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-71-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-72-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-73-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-74-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-75-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-76-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-77-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-78-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-79-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-80-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-81-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-82-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-83-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-84-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-85-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-86-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-87-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-88-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-89-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-90-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-91-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-92-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-93-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-94-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-95-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-96-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-97-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-98-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-99-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-100-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-101-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-102-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-103-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-104-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-105-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-106-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-107-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-108-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-109-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-110-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-111-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-112-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-113-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-114-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig behavioral12/memory/2328-115-0x00007FF6ACD70000-0x00007FF6AD9A3000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 1292 powershell.exe 4 1292 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2328 xmrig.exe -
pid Process 1292 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1292 powershell.exe 1292 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1292 powershell.exe Token: SeLockMemoryPrivilege 2328 xmrig.exe Token: SeLockMemoryPrivilege 2328 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2328 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2328 1292 powershell.exe 78 PID 1292 wrote to memory of 2328 1292 powershell.exe 78
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\file01 - copia (12) - copia.ps1"1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe" -o gulf.moneroocean.stream:10128 -u 45aHvZ4X3ZvdhLiEiP1cjsXmSkMNoM2QFYNmXCsoTRY9h2EwjtoYcfrVpEojtmBeg5cRsY9J82Lqp6hUanQ1Dsu4UNfKxdF2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2328
-
Network
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:8.8.8.8:53Request215.156.26.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgulf.moneroocean.streamIN AResponsegulf.moneroocean.streamIN CNAMEmonerooceans.streammonerooceans.streamIN A149.102.143.109
-
Remote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.236.23
-
Remote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdwus14.westus.cloudapp.azure.comonedscolprdwus14.westus.cloudapp.azure.comIN A20.189.173.15
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.17.107.203a767.dspw65.akamai.netIN A2.17.107.224a767.dspw65.akamai.netIN A2.17.107.225a767.dspw65.akamai.netIN A2.17.107.192
-
Remote address:8.8.8.8:53Request203.107.17.2.in-addr.arpaIN PTRResponse203.107.17.2.in-addr.arpaIN PTRa2-17-107-203deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.17.107.243a767.dspw65.akamai.netIN A2.17.107.138a767.dspw65.akamai.netIN A2.17.107.224a767.dspw65.akamai.netIN A2.17.107.203
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.108.133objects.githubusercontent.comIN A185.199.111.133
-
Remote address:8.8.8.8:53Request133.110.199.185.in-addr.arpaIN PTRResponse133.110.199.185.in-addr.arpaIN PTRcdn-185-199-110-133githubcom
-
Remote address:8.8.8.8:53Request109.143.102.149.in-addr.arpaIN PTRResponse109.143.102.149.in-addr.arpaIN PTRvmi1690904 contaboservernet
-
Remote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.173.189.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request243.107.17.2.in-addr.arpaIN PTRResponse243.107.17.2.in-addr.arpaIN PTRa2-17-107-243deploystaticakamaitechnologiescom
-
1.0kB 8.2kB 10 12
-
74.5kB 3.9MB 1566 2822
-
19.6kB 40.8kB 195 184
-
322 B 7
-
558 B 1.4kB 8 8
DNS Request
github.com
DNS Response
20.26.156.215
DNS Request
215.156.26.20.in-addr.arpa
DNS Request
gulf.moneroocean.stream
DNS Response
149.102.143.109
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.236.23
DNS Request
self.events.data.microsoft.com
DNS Response
20.189.173.15
DNS Request
ctldl.windowsupdate.com
DNS Response
2.17.107.2032.17.107.2242.17.107.2252.17.107.192
DNS Request
203.107.17.2.in-addr.arpa
DNS Request
ctldl.windowsupdate.com
DNS Response
2.17.107.2432.17.107.1382.17.107.2242.17.107.203
-
574 B 1.1kB 8 8
DNS Request
objects.githubusercontent.com
DNS Response
185.199.110.133185.199.109.133185.199.108.133185.199.111.133
DNS Request
133.110.199.185.in-addr.arpa
DNS Request
109.143.102.149.in-addr.arpa
DNS Request
23.236.111.52.in-addr.arpa
DNS Request
15.173.189.20.in-addr.arpa
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
243.107.17.2.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
9.1MB
MD5205ad9eb6acd6f58752899669b69fe74
SHA1bedb78ac5034259b86c2cbc915de2e861e8d7604
SHA2562025f4fe930440da147eecd24a368d3a2f3c1883c499186eb429e9d662c90fda
SHA51228309f453ae87e8db8c1667d8d8eee5f5f7035372c027afbec48aa3c798c53ade7cfcec0c9575cad2d108e033395ebde4fda6fcfff72c99944119f8fa91d91c3