xmrig | 66cf95fbd7e5d2adb54c7be2a49210ac98003bcaef668271a8692865389b840a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Viral RAT 1.0 by Sameed/Viral - Rat By Sameedx.exe
Size 5.5MB
Sample240618-v4fpdaxdql
SHA256 7bbc65ed68543a966e7b166f1e17efb4c1bea40a1d441b03c93f2c225a4c50b6
MD5 0d8a326d2676741da4e4506b0dc0614f
SHA1 cfdf089f3201d44b78248936a77c82dc1122a1ab
SHA512 debeeefdfe9e015b2bac1286bc959490ce0bee1da634f02aa61dab4f4cb2fb8abde69a1dc1680267f2f2e29c1d95afd0625b646b19945f573aa81ec59469a39f
SSDEEP 98304:fJnZwQl/VAQRxdsPKJ/lRM/oO3FX5Tz1m2HK1T2oAcEFZNOwBChw:fJWQl/GQDd3JjPOVXRzPHGTbarxBP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner persistence privilege_escalation

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral4/memory/816-22-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-29-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-31-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-32-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-33-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-30-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-49-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-50-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-51-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-52-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-53-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-54-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-55-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-56-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-57-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-58-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-59-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-60-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-61-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-62-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig
behavioral4/memory/816-63-0x0000000000400000-0x0000000000DCB000-memory.dmp	xmrig

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3104	netsh.exe
4000	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Viral - Rat By Sameedx.exe

Executes dropped EXE 2 IoCs

pid	Process
816	TiWorker.exe
3532	Viral - Rat By Sameed.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config.json	Viral - Rat By Sameedx.exe
File created	C:\Windows\SysWOW64\MicrosoftWindows.xml	Viral - Rat By Sameedx.exe
File opened for modification	C:\Windows\SysWOW64\MicrosoftWindows.xml	Viral - Rat By Sameedx.exe
File created	C:\Windows\SysWOW64\TiWorker.exe	Viral - Rat By Sameedx.exe
File opened for modification	C:\Windows\SysWOW64\TiWorker.exe	Viral - Rat By Sameedx.exe
File created	C:\Windows\SysWOW64\config.json	Viral - Rat By Sameedx.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe
5016	Viral - Rat By Sameedx.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	816	TiWorker.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3532	Viral - Rat By Sameed.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3532	Viral - Rat By Sameed.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 1244	5016	Viral - Rat By Sameedx.exe	80
PID 5016 wrote to memory of 1244	5016	Viral - Rat By Sameedx.exe	80
PID 1244 wrote to memory of 1148	1244	cmd.exe	82
PID 1244 wrote to memory of 1148	1244	cmd.exe	82
PID 1244 wrote to memory of 1992	1244	cmd.exe	83
PID 1244 wrote to memory of 1992	1244	cmd.exe	83
PID 5016 wrote to memory of 3300	5016	Viral - Rat By Sameedx.exe	84
PID 5016 wrote to memory of 3300	5016	Viral - Rat By Sameedx.exe	84
PID 3300 wrote to memory of 4076	3300	cmd.exe	86
PID 3300 wrote to memory of 4076	3300	cmd.exe	86
PID 5016 wrote to memory of 4992	5016	Viral - Rat By Sameedx.exe	87
PID 5016 wrote to memory of 4992	5016	Viral - Rat By Sameedx.exe	87
PID 4992 wrote to memory of 4000	4992	cmd.exe	89
PID 4992 wrote to memory of 4000	4992	cmd.exe	89
PID 5016 wrote to memory of 3900	5016	Viral - Rat By Sameedx.exe	90
PID 5016 wrote to memory of 3900	5016	Viral - Rat By Sameedx.exe	90
PID 3900 wrote to memory of 3104	3900	cmd.exe	92
PID 3900 wrote to memory of 3104	3900	cmd.exe	92
PID 5016 wrote to memory of 532	5016	Viral - Rat By Sameedx.exe	93
PID 5016 wrote to memory of 532	5016	Viral - Rat By Sameedx.exe	93
PID 532 wrote to memory of 1636	532	cmd.exe	95
PID 532 wrote to memory of 1636	532	cmd.exe	95
PID 5016 wrote to memory of 4212	5016	Viral - Rat By Sameedx.exe	96
PID 5016 wrote to memory of 4212	5016	Viral - Rat By Sameedx.exe	96
PID 4212 wrote to memory of 2288	4212	cmd.exe	98
PID 4212 wrote to memory of 2288	4212	cmd.exe	98
PID 4212 wrote to memory of 3392	4212	cmd.exe	99
PID 4212 wrote to memory of 3392	4212	cmd.exe	99
PID 5016 wrote to memory of 3160	5016	Viral - Rat By Sameedx.exe	102
PID 5016 wrote to memory of 3160	5016	Viral - Rat By Sameedx.exe	102
PID 3160 wrote to memory of 2736	3160	cmd.exe	104
PID 3160 wrote to memory of 2736	3160	cmd.exe	104
PID 5016 wrote to memory of 3532	5016	Viral - Rat By Sameedx.exe	105
PID 5016 wrote to memory of 3532	5016	Viral - Rat By Sameedx.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Viral RAT 1.0 by Sameed\Viral - Rat By Sameedx.exe
"C:\Users\Admin\AppData\Local\Temp\Viral RAT 1.0 by Sameed\Viral - Rat By Sameedx.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate" & schtasks /End /TN "WindowsUpdate" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:1148
- - C:\Windows\system32\schtasks.exe
    schtasks /End /TN "WindowsUpdate"
    3⤵
    PID:1992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Delete /TN "WindowsUpdate" /F & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\system32\schtasks.exe
    schtasks /Delete /TN "WindowsUpdate" /F
    3⤵
    PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=out action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=out action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="System" dir=in action=allow program="%windir%\SysWOW64\TiWorker.exe" enable=yes & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3900
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="System" dir=in action=allow program="C:\Windows\SysWOW64\TiWorker.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Create /XML "%windir%\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /XML "C:\Windows\SysWOW64\MicrosoftWindows.xml" /TN "Microsoft\Windows\MUI\WindowsUpdate" /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "%windir%\SysWOW64\TiWorker.exe" & schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\system32\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\MUI\WindowsUpdate" /TR "C:\Windows\SysWOW64\TiWorker.exe"
    3⤵
    PID:2288
- - C:\Windows\system32\schtasks.exe
    schtasks /Run /TN "Microsoft\Windows\MUI\WindowsUpdate"
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil –addstore –f root MicrosoftWindows.crt & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\system32\certutil.exe
    certutil –addstore –f root MicrosoftWindows.crt
    3⤵
    PID:2736
- C:\Users\Admin\AppData\Local\Temp\Viral RAT 1.0 by Sameed\Viral - Rat By Sameed.exe
  "C:\Users\Admin\AppData\Local\Temp\Viral RAT 1.0 by Sameed\Viral - Rat By Sameed.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3532

C:\Windows\SysWOW64\TiWorker.exe
C:\Windows\SysWOW64\TiWorker.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftWindows.crt

Path C:\Users\Admin\AppData\Local\Temp\MicrosoftWindows.crt
Size 1KB
SHA256 1bf4ce2aedc0cfb1365ab15c7e0c8c26b87890ad4008d56317b756b8745ff580
MD5 1bb617d3aab1dbe2ec2e4a90bf824846
SHA1 bbe179f1bdc4466661da3638420e6ca862bd50ca
SHA512 ed91750bec3aed806088c271e295550dac1c8cae91569f278d40fbd671b486e70cc9b28f7a9a70e9f340fbe8a038f1ed18f666de4246fc1d60e015e0dd3f1c52
MD5 SHA1 SHA512

Submit Download

Viral - Rat By Sameed.exe

Path C:\Users\Admin\AppData\Local\Temp\Viral RAT 1.0 by Sameed\Viral - Rat By Sameed.exe
Size 2.5MB
SHA256 4db9721f4c76b487e34fa87bb6a76632fb37873de18982892268a70b18b8a4a9
MD5 e3c2ee5e644cd9db626f2e29030131cf
SHA1 08aa271d62745c434cf68e1e492b466d5301a003
SHA512 9ff3abcb747a6cd3efa5d56aea7f57e62e4389b9bcfce491c46e825d227e497e4d35a2faaf91a3e3c8ad79a5a5c21a3a75d27ed7ad3ac452eccaeb1fbef2d58d
SSDEEP 24576:3S9wlTzi2gQO1PMV2DCHAJ2glv9fJVOYfJSzaSArbz2jQABLq1Vo/pfhqqtLBfGC:i9ijgQO1PMDozYAPz2UbrEJEKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut4DD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut4DD2.tmp
Size 3.2MB
SHA256 366f1e9f9c99aa81034bada3cc344f2fb5a74246e1d5851441244df1ecc9ae6d
MD5 ecede3c32ce83ff76ae584c938512c5a
SHA1 090b15025e131cc03098f6f0d8fa5366bc5fa1f0
SHA512 61ca6075c8a2086d42b58698484afc0005645507474831cacafc10126f47c8f0cda10c1c215557f9391865b55b16ae881a593d7547cbad560b54369684b23d1d
SSDEEP 49152:N210MUP/QasKAudcN6Ex7HMy8QUKV9YEF1x7G19wCrbuyjIfAbssd45UVFJxZVCw:RH0JgEx7XHjpvx7S91JjIfAoaB478
MD5 SHA1 SHA512 SSDEEP

Submit Download

MicrosoftWindows.xml

Path C:\Windows\SysWOW64\MicrosoftWindows.xml
Size 4KB
SHA256 96f2ff4ddcadf6421071daa6cdda2ce866fb7b10d12cc1b20bd07cb131210430
MD5 b1cbfcc7b7a5716a30b77f5dc5bb6135
SHA1 5c397ffd7a845b2fdf9e82ff73698784a91a2fb9
SHA512 d08516e7610e5a08d1c5c2d1cc5a22b1cd2d6b7c890f895caee0cf65577a1315d575d91a8f7f78ffc7bd0dd77b23ece46fadf58ba44257a115330a54a3ebfcf7
SSDEEP 96:tb2r2Vj+CBdRin6h4ukiCipV9ll7EHFFPh+:bECBdRXvCeOHZ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Windows\SysWOW64\config.json
Size 1011B
SHA256 f86ab68eaddd22fbe679ea5ab9cc54775e74081beffd758b30776ba103f396eb
MD5 3da156f2d3307118a8e2c569be30bc87
SHA1 335678ca235af3736677bd8039e25a6c1ee5efca
SHA512 59748e02cc4b7f280471b411d6ca3c9986f4c12f84b039bae25269634fc825cde417fe46246f58538668c19cca91e698e31d9f32df69aad89e68423f86bb00c0
MD5 SHA1 SHA512

Submit Download

memory/816-55-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-49-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-31-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-32-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-33-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-30-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-22-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-20-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-63-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-62-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-61-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-60-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-59-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-29-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-50-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-51-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-52-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-53-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-54-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-19-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-56-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-57-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/816-58-0x0000000000400000-0x0000000000DCB000-memory.dmp

Download

memory/3532-48-0x000000001C090000-0x000000001C0DC000-memory.dmp

Download

memory/3532-47-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Download

memory/3532-46-0x000000001BF30000-0x000000001BFCC000-memory.dmp

Download

memory/3532-45-0x000000001B9C0000-0x000000001BE8E000-memory.dmp

Download

memory/3532-44-0x000000001B440000-0x000000001B4E6000-memory.dmp

Download