xmrig | d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a

General

Target
d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
Size 2.5MB
Sample260930-ksj8batepc
SHA256 d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a
MD5 7c23db04dea3c1efdf6429ef5968cfbd
SHA1 e4350e6a96fc7746a22f0c50525de9542e0fc787
SHA512 7316e1fd6aa8c19986be6a0b208723becfbd6681b8c34c4273fb888965de9a39b39280777dc8847a7ba94bad06b4e60ae2c90c8addc8e42dcf257413a289e546
SSDEEP 49152:jZB1G8YqyQq6sxoIqj1EW/yM+Y0CHiN42dhDdBP44RGSEt2Y:93GcyisaIqBXyMgCCNTDPRGSa
TLSH
T198C51249E2E509F8E0A7E578C9978D16F7763C4E03719A8F13A4165B1F633A0DE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c50d-29.dat	family_xmrig
behavioral2/files/0x000d00000001c50d-29.dat	xmrig
behavioral2/files/0x000d00000001c512-32.dat	family_xmrig
behavioral2/files/0x000d00000001c512-32.dat	xmrig

Executes dropped EXE 2 IoCs

pid	Process
5404	scrvt.exe
2576	scrvt.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SQLevgGHfkhgJnohpp = "C:\\Windows\\System32\\fckv.vbs"	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\SQLevgGHfkhgJnohpp = "C:\\Windows\\System32\\fckv.vbs"	WScript.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	C:\Windows\System32\__tmp_rar_sfx_access_check_240744843	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File created	C:\Windows\System32\cpp.bat	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File opened for modification	C:\Windows\System32\cpp.bat	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File created	C:\Windows\System32\fckv.vbs	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File opened for modification	C:\Windows\System32\tmtu.vbs	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File opened for modification	C:\Windows\System32\cmrig.exe	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File opened for modification	C:\Windows\System32\config.json	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File created	C:\Windows\System32\tmtu.vbs	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File created	C:\Windows\System32\mbs.txt	WScript.exe
File created	C:\Windows\System32\scrvt.exe	cmd.exe
File created	C:\Windows\System32\config.json	scrvt.exe
File created	C:\Windows\System32\config.json	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File opened for modification	C:\Windows\System32\scrvt.exe	cmd.exe
File created	C:\Windows\System32\config.json	scrvt.exe
File opened for modification	C:\Windows\System32\fckv.vbs	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
File created	C:\Windows\System32\cmrig.exe	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
4672	WScript.exe
1068	WScript.exe
4300	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1736	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	scrvt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	scrvt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	scrvt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	scrvt.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2576	scrvt.exe
Token: SeLockMemoryPrivilege	5404	scrvt.exe
Token: SeLockMemoryPrivilege	5404	scrvt.exe
Token: SeLockMemoryPrivilege	2576	scrvt.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5404	scrvt.exe
2576	scrvt.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 4672	5228	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe	89
PID 5228 wrote to memory of 1068	5228	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe	90
PID 5228 wrote to memory of 1736	5228	d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe	91
PID 4300 wrote to memory of 5404	4300	WScript.exe	96
PID 1068 wrote to memory of 2576	1068	WScript.exe	98

C:\Users\Admin\AppData\Local\Temp\d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe
"C:\Users\Admin\AppData\Local\Temp\d5c3b80d177cab4e4282c9eed9d0af2663928aab1985de6d3a2b57f61472677a.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System32\tmtu.vbs"
  2⤵
  - Drops file in System32 directory
  - Executes a VBScript file via the Windows Script Host.
  PID:4672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System32\fckv.vbs"
  2⤵
  - Adds Run key to start application
  - Executes a VBScript file via the Windows Script Host.
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\System32\scrvt.exe
    "C:\Windows\System32\scrvt.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\cpp.bat" "
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  PID:1736

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Windows\System32\fckv.vbs"
1⤵
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\scrvt.exe
  "C:\Windows\System32\scrvt.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmrig.exe

Path C:\Windows\System32\cmrig.exe
Size 6.1MB
SHA256 023f838fa603ca595e6b44a8f1736769addda00f977251e714f5d19c50cfee34
MD5 1ef3db8d59e1fc857b30fe90aaac59d9
SHA1 7c9bc386f485340d7d0d080c37e80d71f63d088c
SHA512 041aa6595022cbabe26d559c0c074910eb4edfe63df9be484a53dc301804f0e6642be5466e15cbc0979a0853a2b0559d59dd9f56050d365fa0deeeee32807d28
SSDEEP 98304:YqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQF:YRC/NM0rDoxrix2PkZvdAv5n1gpgR
TLSH
T1F5569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Windows\System32\config.json
Size 2KB
SHA256 ab4528196ac29681a897f4f2063bf46b9fa8605ee7a57103ae3b69acd2e08c62
MD5 32b5937bdce137feacfb286ecdd46962
SHA1 e9dfcb1291627ce32fc9dd36e8c2c310cc2ac36c
SHA512 07b291406ff330e74d4d3d16a12dbfc8d57d59ae08604c300ce297e45a10201edf2ada8b59648879017029592f7cf9d7d65609ac44d3080181d12f240e9a84ce
TLSH
T16251C415C9780CFA0695A0AC88ECA393462882075F593C3C754C499C2F0E73E75B7BD2
MD5 SHA1 SHA512 TLSH

Submit Download

cpp.bat

Path C:\Windows\System32\cpp.bat
Size 88B
SHA256 6005ec56303d8f32952dacb594d49fe5f873165452951fd1d4d58d39df1c9e47
MD5 f9688331dbd7bed560c78a0c000cf0f4
SHA1 27fae4599e1daed23d2e486bae9717db823520d7
SHA512 e34ab732b9ca24f804d3f7f70b2bafa40e1bb310d575ed8aae111022e8617281adeab5089bba71e772bff44fefdd82472557e034d9ebf713a759153d31e534ac
TLSH
T1A6B01253041E54E1C4241270857FB8318335208F500021D0528151C1C45015C0B948BC
MD5 SHA1 SHA512 TLSH

Submit Download

fckv.vbs

Path C:\Windows\System32\fckv.vbs
Size 1KB
SHA256 02ac099de44ec85b52ca068deda66480e257485a66d37d76c7f86d4559fc0148
MD5 7a99ac89de9eeccb225e91124827d476
SHA1 b764931132b672fa4c1c066f109b5cd2f7032a6d
SHA512 2351cf6f8c376f800d3c8acb36be7590d87d7abfbe0b0cff38281bd1795d1406952f7d783288d0fdf88b8b1af578e6887f5e2bd039d6e811eceecf9fb8516b14
TLSH
T131314310F51EE1B090FF2F1239BBC51AEDE11563763BD178B59CC4984FB116886A46B3
MD5 SHA1 SHA512 TLSH

Submit Download

mbs.txt

Path C:\Windows\System32\mbs.txt
Size 170B
SHA256 6eb4a6132ad91c7d699cfa084c50f3733a0c13b0db103c054cee9adbc932126a
MD5 2c442e64baaf75d262340a9c02a9fa0a
SHA1 688f1290de8ed7ebf48438ab00f3de275ec823b2
SHA512 b92c7598f6347d220ad9cb26995b38953a2634162e4c68984d039b706fbac0f033f0352b2bb7f38320d272c1bda7feb8b09a8cccaaf39a2d0d51402baaa31992
TLSH
T164C080DD445F319022DC474951575057560D4405D1D47448D1453D299421A5FD51F6B5
MD5 SHA1 SHA512 TLSH

Submit Download

scrvt.exe

Path C:\Windows\System32\scrvt.exe
Size 6.1MB
SHA256 2d59b4b40c9ba85c536f17496b4ea1c3311f72f6e51a030281984e896dff2e22
MD5 4110af691f225750db8118fd4468a5a7
SHA1 55cd9ad6c0b2653c653491bbabe9524ae5376e04
SHA512 3e0077a56095f53283963f3285fe25e109e30f5275e0aa832724fb9d211274768cfb668aca33d3eebeccc8d827ac13f0c6e8c29964192877d8d81bc28049b49d
SSDEEP 98304:YqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQL:YRC/NM0rDoxrix2PkZvdAv5n1gpgRp
TLSH
T1D4569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmtu.vbs

Path C:\Windows\System32\tmtu.vbs
Size 369B
SHA256 2abcb5e26f257c681ec367f5aa7d9caafa877bfe92e6a7bbdd13ec479abb2b20
MD5 542846b77b7c26eb9a61dd8249d778da
SHA1 e7810dfec783a06769b726c77ff9d3ea3949289f
SHA512 749132aa1aa2daaf0d482fdf474dc53b3100ad499d0014004105543b32324d17e74e838c742c0894967a4aa4c2737a77da8dfa77cd8d6fc569a57bbf5c790b3c
TLSH
T178E02680F057880A0A720B8540C5512AFA50B1772037893CB74F9A658F3BF2D1AB40FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5404-35-0x000001EB12400000-0x000001EB12420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads