General
-
Target
684d5c62ffa1b2e8024c9ec17482d058.exe
-
Size
333KB
-
Sample
220127-jfvb3shdgk
-
MD5
684d5c62ffa1b2e8024c9ec17482d058
-
SHA1
3b205c2e5066e422702151b5eaa00ec444543874
-
SHA256
9dd979c20bd6d843da8f29afc35c0ec2a79bcb5f5100a0d70103509e58c1c5f5
-
SHA512
cf4a16a19c97fec5c74ac4dcb75bb4305b2437fa1b01490ec8e19574374beda204002902a5981b0ba51268e4e6e8b4cb7865c40dc3b4df068845831190dddba4
Static task
static1
Behavioral task
behavioral1
Sample
684d5c62ffa1b2e8024c9ec17482d058.exe
Resource
win7-en-20211208
Malware Config
Extracted
tofsee
patmushta.info
ovicrush.cn
Targets
-
-
Target
684d5c62ffa1b2e8024c9ec17482d058.exe
-
Size
333KB
-
MD5
684d5c62ffa1b2e8024c9ec17482d058
-
SHA1
3b205c2e5066e422702151b5eaa00ec444543874
-
SHA256
9dd979c20bd6d843da8f29afc35c0ec2a79bcb5f5100a0d70103509e58c1c5f5
-
SHA512
cf4a16a19c97fec5c74ac4dcb75bb4305b2437fa1b01490ec8e19574374beda204002902a5981b0ba51268e4e6e8b4cb7865c40dc3b4df068845831190dddba4
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-