Introduction

---

📌 Behavior Summary

Initial Access

The malware begins execution as bMbOxiDNSB.exe (MD5: 79DDA151FAFDC3B2BF29ED0A97D340AD), which was identified as malicious by multiple antivirus engines with detection rates of 56-66%.

Evasion Techniques

The malware employs several anti-analysis and evasion mechanisms:

• Direct syscalls to bypass EDR detection, observed in both the initial executable and the dropped updater.exe
• Execution stalling through Sleep API calls to delay analysis
• Sandbox detection functionality that compares user and computer characteristics
• Obfuscated PowerShell commands using character substitution and string concatenation techniques
• Self-deletion via a cmd.exe process that waits 3 seconds before deleting the original executable

Persistence Mechanisms

The malware establishes persistence through multiple methods:

• Scheduled task creation named "GoogleUpdateTaskMachineQC" that executes C:\Users\user\AppData\Roaming\Google\Chrome\updater.exe at logon with highest privileges
• Registry Run key modification as a fallback persistence method when administrative privileges are unavailable
• The persistence commands are executed via PowerShell scripts that check for administrative privileges and adapt accordingly

Payload Execution and Injection

Extensive process injection activity occurs throughout the execution:

• Thread injection into multiple legitimate processes including dialer.exe (PID 6932), dllhost.exe (PID 1900), and dialer.exe (PID 1120)
• PE injection into dllhost.exe, winlogon.exe, and lsass.exe processes
• Memory mapping of malicious code into dialer.exe with read-only protection
• Code injection into Windows Explorer (explorer.exe)
• Hooking of system functions in winlogon.exe, including file/directory queries, process queries, and registry key queries to hide malicious activity

Cryptocurrency Mining Activity

YARA signatures identified the malware as SilentCrypto Miner, indicating cryptocurrency mining capabilities. The malware queries video controller information using WMIC and outputs results to C:\Users\user\AppData\Roaming\Google\Libs\g.log, likely for hardware profiling to optimize mining operations.

Process Relationships

• bMbOxiDNSB.exe spawns multiple PowerShell processes for persistence setup and payload execution
• The malware drops and executes updater.exe (identical MD5 to original), which repeats the persistence setup process
• PowerShell processes (PIDs 2344, 5164) launched by the system execute obfuscated scripts containing dynamic assembly creation and delegate functionality
• dllhost.exe spawns svchost.exe with BITS service parameters, likely for network communication

MITRE ATT&CK TTPs

• T1055 - Process Injection (thread injection, PE injection, memory mapping)
• T1053.005 - Scheduled Task/Job: Scheduled Task
• T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys
• T1027 - Obfuscated Files or Information (PowerShell obfuscation)
• T1562.001 - Impair Defenses: Disable or Modify Tools (function hooking)
• T1140 - Deobfuscate/Decode Files or Information
• T1057 - Process Discovery (sandbox detection)
• T1082 - System Information Discovery (hardware profiling)

IOCs

Threat Graph

(not actually useful I just thought it was cool)

Full Execution History

For those interested in the full execution history :

cmd.exe /d /s /c "taskkill /F /IM msedge.exe"