Resubmissions

11/02/2025, 16:33 UTC

250211-t2ztsstkey 10

11/02/2025, 16:33 UTC

250211-t2zh2atkex 10

11/02/2025, 16:33 UTC

250211-t2yxhatkew 10

11/02/2025, 16:33 UTC

250211-t2nrjasqdk 10

24/10/2024, 20:12 UTC

241024-yyvg5asemn 10

24/10/2024, 20:11 UTC

241024-yygk9ssemk 10

24/10/2024, 20:11 UTC

241024-yygahasemj 10

24/10/2024, 20:11 UTC

241024-yyd55sselq 10

24/10/2024, 20:08 UTC

241024-yw247asdqp 10

24/10/2024, 20:08 UTC

241024-yw1lcssdqn 10

Analysis

  • max time kernel
    1799s
  • max time network
    1787s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 20:59 UTC

General

  • Target

    grhddhsGHswgh/qM5GMXBk6hJE6Y5e (16).exe

  • Size

    2.0MB

  • MD5

    a16a669a09bf158058b83e04e69fe38e

  • SHA1

    f6c94763850d9e590d86057139e8895a7aacdeea

  • SHA256

    cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

  • SHA512

    658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

  • SSDEEP

    49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 30 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (16).exe
        "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (16).exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2256
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
          3⤵
            PID:2788
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (16).exe"
          2⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:2904
          • C:\Windows\System32\choice.exe
            choice /C Y /N /D Y /T 3
            3⤵
              PID:2896
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1508
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2576
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2368
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe qtdiqnkejoz
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious behavior: EnumeratesProcesses
            PID:1800
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:1624
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic PATH Win32_VideoController GET Name, VideoProcessor
              3⤵
              • Detects videocard installed
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:1708
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Drops file in Program Files directory
            PID:1196
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1200
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {DAEA8E26-4947-4F1F-9459-95762A483A9C} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2624

        Network

        • flag-us
          DNS
          pool.hashvault.pro
          conhost.exe
          Remote address:
          8.8.8.8:53
          Request
          pool.hashvault.pro
          IN A
          Response
          pool.hashvault.pro
          IN A
          95.179.241.203
          pool.hashvault.pro
          IN A
          45.76.89.70
        • 95.179.241.203:3333
          pool.hashvault.pro
          tls
          conhost.exe
          7.9kB
          57.2kB
          113
          115
        • 8.8.8.8:53
          pool.hashvault.pro
          dns
          conhost.exe
          64 B
          96 B
          1
          1

          DNS Request

          pool.hashvault.pro

          DNS Response

          95.179.241.203
          45.76.89.70

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Google\Chrome\updater.exe

          Filesize

          2.0MB

          MD5

          a16a669a09bf158058b83e04e69fe38e

          SHA1

          f6c94763850d9e590d86057139e8895a7aacdeea

          SHA256

          cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

          SHA512

          658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

        • C:\Program Files\Google\Libs\g.log

          Filesize

          198B

          MD5

          37dd19b2be4fa7635ad6a2f3238c4af1

          SHA1

          e5b2c034636b434faee84e82e3bce3a3d3561943

          SHA256

          8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

          SHA512

          86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z4OH7WQE637HBKIRE6PS.temp

          Filesize

          7KB

          MD5

          928e6e6f3bae1ba7265e5c6a064aee1a

          SHA1

          00ca9b9f36e74eca794a82d91925cebbb75e0a68

          SHA256

          477bc86c6e674ee8bca72db43c943973f3e4d672ab43779514462c900554af8a

          SHA512

          caa444772c4da4a957fec71653bbd9cdf90a11a2dcab4c7ae2837cc9be92efac5082b186f12c89f79ec3ac41deb2fda027f73c9e39c715005aebb54e2d7761d9

        • memory/1200-74-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-76-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-100-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-98-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-96-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-94-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-92-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-90-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-88-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-52-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-84-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-82-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-80-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-78-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-50-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-40-0x0000000000380000-0x00000000003A0000-memory.dmp

          Filesize

          128KB

        • memory/1200-72-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-41-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-43-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-70-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-44-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-46-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-48-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-68-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-66-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-86-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-54-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-56-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-58-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-60-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-62-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1200-64-0x0000000140000000-0x00000001407F4000-memory.dmp

          Filesize

          8.0MB

        • memory/1800-47-0x0000000140000000-0x0000000140016000-memory.dmp

          Filesize

          88KB

        • memory/1800-42-0x0000000140000000-0x0000000140016000-memory.dmp

          Filesize

          88KB

        • memory/2220-0-0x000000013F4C0000-0x000000013F6D1000-memory.dmp

          Filesize

          2.1MB

        • memory/2220-23-0x000000013F4C0000-0x000000013F6D1000-memory.dmp

          Filesize

          2.1MB

        • memory/2256-7-0x0000000002080000-0x0000000002088000-memory.dmp

          Filesize

          32KB

        • memory/2256-13-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

          Filesize

          9.6MB

        • memory/2256-9-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

          Filesize

          9.6MB

        • memory/2256-8-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

          Filesize

          9.6MB

        • memory/2256-5-0x000007FEF5BBE000-0x000007FEF5BBF000-memory.dmp

          Filesize

          4KB

        • memory/2256-10-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

          Filesize

          9.6MB

        • memory/2256-12-0x000007FEF5900000-0x000007FEF629D000-memory.dmp

          Filesize

          9.6MB

        • memory/2256-11-0x000000000299B000-0x0000000002A02000-memory.dmp

          Filesize

          412KB

        • memory/2256-6-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

          Filesize

          2.9MB

        • memory/2280-19-0x00000000029A0000-0x0000000002A20000-memory.dmp

          Filesize

          512KB

        • memory/2280-20-0x000000001B410000-0x000000001B6F2000-memory.dmp

          Filesize

          2.9MB

        • memory/2280-21-0x00000000027A0000-0x00000000027A8000-memory.dmp

          Filesize

          32KB

        • memory/2624-39-0x000000013F250000-0x000000013F461000-memory.dmp

          Filesize

          2.1MB

        • memory/2624-32-0x000000013F250000-0x000000013F461000-memory.dmp

          Filesize

          2.1MB

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.