Analysis
-
max time kernel
61s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
29-04-2021 15:46
Static task
static1
Behavioral task
behavioral1
Sample
file3.exe
Resource
win7v20210410
General
-
Target
file3.exe
-
Size
4.4MB
-
MD5
85916ca32ad6adf4bcc68318fcfe1722
-
SHA1
e58a67d48b79cc828e31121f5c3ed2b06ebd4f85
-
SHA256
3e3a2350cc65c94f1139adf4229a5d1a0c0fdd7aa79c5ba8612011e2a5113b0f
-
SHA512
db3e042b77f5f4b5e1b83dac49f24e1159552c7a7207ab2897e44bcb58875dc87a84257ef3ca95606c565d7baaa55db67f36f47d8adcfb8b4aa9d5aa522dfb90
Malware Config
Signatures
-
XMRig Miner Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1248-124-0x0000000000400000-0x0000000000872000-memory.dmp xmrig behavioral2/memory/1248-125-0x000000000086D6EA-mapping.dmp xmrig C:\Users\Admin\AppData\Roaming\xmrig.exe xmrig C:\Users\Admin\AppData\Roaming\xmrig.exe xmrig -
Executes dropped EXE 1 IoCs
Processes:
xmrig.exepid process 3956 xmrig.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file3.exedescription pid process target process PID 3540 set thread context of 1248 3540 file3.exe file3.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
file3.exepid process 3540 file3.exe 3540 file3.exe 3540 file3.exe 3540 file3.exe 3540 file3.exe 3540 file3.exe 3540 file3.exe 3540 file3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
file3.exexmrig.exedescription pid process Token: SeDebugPrivilege 3540 file3.exe Token: SeLockMemoryPrivilege 3956 xmrig.exe Token: SeLockMemoryPrivilege 3956 xmrig.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
file3.exefile3.exedescription pid process target process PID 3540 wrote to memory of 2284 3540 file3.exe file3.exe PID 3540 wrote to memory of 2284 3540 file3.exe file3.exe PID 3540 wrote to memory of 2284 3540 file3.exe file3.exe PID 3540 wrote to memory of 2192 3540 file3.exe file3.exe PID 3540 wrote to memory of 2192 3540 file3.exe file3.exe PID 3540 wrote to memory of 2192 3540 file3.exe file3.exe PID 3540 wrote to memory of 1940 3540 file3.exe file3.exe PID 3540 wrote to memory of 1940 3540 file3.exe file3.exe PID 3540 wrote to memory of 1940 3540 file3.exe file3.exe PID 3540 wrote to memory of 932 3540 file3.exe file3.exe PID 3540 wrote to memory of 932 3540 file3.exe file3.exe PID 3540 wrote to memory of 932 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 3540 wrote to memory of 1248 3540 file3.exe file3.exe PID 1248 wrote to memory of 3956 1248 file3.exe xmrig.exe PID 1248 wrote to memory of 3956 1248 file3.exe xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file3.exe"C:\Users\Admin\AppData\Local\Temp\file3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file3.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\file3.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\file3.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\file3.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\file3.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\xmrig.exe"C:\Users\Admin\AppData\Roaming\xmrig.exe" -p trinity-miner --donate-level 5 -o pool.supportxmr.com:443 -u 89UyhNJWGyP6xoycGBA3A6HjdNEs7g3jr34EXVtqGYzg5wLEbmZY2AcGy5Kw5NRfjaYTUyW1dKCHGinv7fGMg45zVCRQwNM -k --tls3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file3.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Roaming\xmrig.exeMD5
184fb976a5e2ff8241f6d7799ba930be
SHA16b9043b37361225cb709ef927f23cbac65063588
SHA256fd0f5b78bcc0c8c9690777f1be1602f006e627fff201b8111275a10edfb76c83
SHA5129752bd4251a6f2daac1525ecb345e2026fd00647f8e0120dc577341b6b216f3934ff11398ef77742bb4621a90fddeabceb6757d527d2e13bd10ae6e154fbf2c9
-
C:\Users\Admin\AppData\Roaming\xmrig.exeMD5
184fb976a5e2ff8241f6d7799ba930be
SHA16b9043b37361225cb709ef927f23cbac65063588
SHA256fd0f5b78bcc0c8c9690777f1be1602f006e627fff201b8111275a10edfb76c83
SHA5129752bd4251a6f2daac1525ecb345e2026fd00647f8e0120dc577341b6b216f3934ff11398ef77742bb4621a90fddeabceb6757d527d2e13bd10ae6e154fbf2c9
-
memory/1248-124-0x0000000000400000-0x0000000000872000-memory.dmpFilesize
4.4MB
-
memory/1248-125-0x000000000086D6EA-mapping.dmp
-
memory/3540-123-0x000000000BFF0000-0x000000000C460000-memory.dmpFilesize
4.4MB
-
memory/3540-116-0x0000000006090000-0x0000000006091000-memory.dmpFilesize
4KB
-
memory/3540-122-0x00000000099A0000-0x0000000009C78000-memory.dmpFilesize
2.8MB
-
memory/3540-114-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/3540-120-0x0000000005B90000-0x000000000608E000-memory.dmpFilesize
5.0MB
-
memory/3540-119-0x00000000077A0000-0x00000000077A1000-memory.dmpFilesize
4KB
-
memory/3540-118-0x0000000005D90000-0x0000000005D91000-memory.dmpFilesize
4KB
-
memory/3540-121-0x0000000005E60000-0x0000000005E6E000-memory.dmpFilesize
56KB
-
memory/3540-117-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/3956-129-0x0000000000000000-mapping.dmp
-
memory/3956-132-0x000001C4A56F0000-0x000001C4A5710000-memory.dmpFilesize
128KB
-
memory/3956-133-0x000001C4A5720000-0x000001C4A5740000-memory.dmpFilesize
128KB
-
memory/3956-135-0x000001C4A5760000-0x000001C4A5780000-memory.dmpFilesize
128KB
-
memory/3956-134-0x000001C4A5740000-0x000001C4A5760000-memory.dmpFilesize
128KB