Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-05-2021 16:57
Static task
static1
Behavioral task
behavioral1
Sample
82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe
-
Size
1.5MB
-
MD5
823f26a80be46a78c0165bff11c19070
-
SHA1
d580906a344590011caf1f980143887a4a903c58
-
SHA256
82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68
-
SHA512
440b0721f5739c3310f73788809619c0cea0f7a46dabe7eb7cd69a99373cd8dda2876b7e49be0d7eaa9d1c7e89dda406e3659be7500050d90f8e707a6998d377
Malware Config
Signatures
-
XMRig Miner Payload 2 IoCs
resource yara_rule behavioral1/memory/916-68-0x0000000000502B90-mapping.dmp xmrig behavioral1/memory/916-69-0x0000000000400000-0x0000000000504000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/916-66-0x0000000000400000-0x0000000000504000-memory.dmp upx behavioral1/memory/916-67-0x0000000000400000-0x0000000000504000-memory.dmp upx behavioral1/memory/916-69-0x0000000000400000-0x0000000000504000-memory.dmp upx -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EJMbfDcdzM.url wscript.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 484 set thread context of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe Token: SeLockMemoryPrivilege 916 notepad.exe Token: SeLockMemoryPrivilege 916 notepad.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 484 wrote to memory of 840 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 30 PID 484 wrote to memory of 840 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 30 PID 484 wrote to memory of 840 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 30 PID 484 wrote to memory of 840 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 30 PID 840 wrote to memory of 616 840 cmd.exe 32 PID 840 wrote to memory of 616 840 cmd.exe 32 PID 840 wrote to memory of 616 840 cmd.exe 32 PID 840 wrote to memory of 616 840 cmd.exe 32 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33 PID 484 wrote to memory of 916 484 82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe"C:\Users\Admin\AppData\Local\Temp\82c911654f0ee48371791f470c0998e9a82e8c09df8dcb8a1257b795922a4b68.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.execmd.exe /C WScript "C:\ProgramData\GCxcrhlcfj\r.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\wscript.exeWScript "C:\ProgramData\GCxcrhlcfj\r.vbs"3⤵
- Drops startup file
PID:616
-
-
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe" -c "C:\ProgramData\GCxcrhlcfj\cfgi"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:916
-