ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe
1MB
21-05-2022 00:52
behavioral2
ce854dd32e1d931cd6a791b30dcd9458
0b247814ee8be3926e0dd64e749d7a4f174f96b7
ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a
12cc6264daa1deaf81d59153f8cb9f9ed5b67dd45d6c954706c4a9052807384395ceb008b082e9bf903493dc9e52769fcf91a8295be9beae95655691a72c7e42
Filter: none
-
xmrig
Description
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Tags
-
XMRig Miner Payload
Tags
Reported IOCs
resource yara_rule behavioral2/memory/3960-135-0x0000000000624080-mapping.dmp xmrig behavioral2/memory/3960-138-0x0000000000400000-0x0000000000626000-memory.dmp xmrig behavioral2/memory/3960-141-0x000000000058C000-0x0000000000625000-memory.dmp xmrig -
UPX packed file
Description
Detects executables packed with UPX/modified UPX open source packer.
Tags
Reported IOCs
resource yara_rule behavioral2/memory/3960-130-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-132-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-133-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-136-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-137-0x0000000000400000-0x0000000000626000-memory.dmp upx behavioral2/memory/3960-138-0x0000000000400000-0x0000000000626000-memory.dmp upx -
Drops startup filewscript.exe
Reported IOCs
description ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zylUYKzaGy.url wscript.exe -
Suspicious use of SetThreadContextac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe
Reported IOCs
description pid process target process PID 3184 set thread context of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe -
Suspicious behavior: EnumeratesProcessesac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe
Reported IOCs
pid process 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe -
Suspicious use of AdjustPrivilegeTokenac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exenotepad.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe Token: SeLockMemoryPrivilege 3960 notepad.exe Token: SeLockMemoryPrivilege 3960 notepad.exe -
Suspicious use of WriteProcessMemoryac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.execmd.exe
Reported IOCs
description pid process target process PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 3960 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe notepad.exe PID 3184 wrote to memory of 2852 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe cmd.exe PID 3184 wrote to memory of 2852 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe cmd.exe PID 3184 wrote to memory of 2852 3184 ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe cmd.exe PID 2852 wrote to memory of 364 2852 cmd.exe wscript.exe PID 2852 wrote to memory of 364 2852 cmd.exe wscript.exe PID 2852 wrote to memory of 364 2852 cmd.exe wscript.exe
-
C:\Users\Admin\AppData\Local\Temp\ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exePID:3184"C:\Users\Admin\AppData\Local\Temp\ac4daabcc33e6d296965a9e4b5af21fa43e47f49c58da62c420ebb66694b819a.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\notepad.exePID:3960"C:\Windows\notepad.exe" -c "C:\ProgramData\iEtHqNVRGt\cfgi"Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exePID:2852cmd.exe /C WScript "C:\ProgramData\iEtHqNVRGt\r.vbs"Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exePID:364WScript "C:\ProgramData\iEtHqNVRGt\r.vbs"Drops startup file
-
C:\ProgramData\iEtHqNVRGt\cfgi
MD534bb94db8839a2aaeac48594a3f0ebe8
SHA1ba81d8aa9c4309a35c8e1f0a58791c3d39bf5edd
SHA256c09aec150148504183dac3ea39b5d3f04bb1779f27da8cca219e1990071cbede
SHA51286ebc7ead25933cac0c0668fb5a4d2dea38dabee20f0771a30ffa79d0a852bae19f659ae4b29fce72d4cfd4e26264874fb4566211b03e9dc554e53425b26a592
-
C:\ProgramData\iEtHqNVRGt\r.vbs
MD5b23a1fc8e307280ef31a642edfce3a21
SHA1383a780d371e77d5235420d88e951784397fe92d
SHA25673d8861c33c983a15faa95dddb4cdbc2b4937884e806a7d84bf8442bc7861067
SHA51204c753ef23e9d8f02f3e022e61efa68ee0c284f4395d4dbbf561a643ff998b377e767e19411b53b382bb4fb8b17fdeb7214bbe3cac14ab40f5aefb396413a0f8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zylUYKzaGy.url
MD50635cf33c47c96c413afe48d40842b84
SHA1f3c064987470725dea67c15807dbb7efb52fc72b
SHA2560c7b61e072a3b51c27d9b1beb7751a49fc830973f7f4069c2651af5f049b8dc3
SHA512bfb65c35d2431eeca8c8635646517e94692d770edc8884d1c297a2b1688946288589196fb3fa409e81a351c894e30693e7d4cfffdfe4fbc85267ac8164483bae
-
memory/364-145-0x0000000000000000-mapping.dmp
-
memory/2852-144-0x0000000000000000-mapping.dmp
-
memory/3960-140-0x000001E0B58D0000-0x000001E0B58E0000-memory.dmp
-
memory/3960-138-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-137-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-135-0x0000000000624080-mapping.dmp
-
memory/3960-142-0x0000000000401000-0x000000000058C000-memory.dmp
-
memory/3960-141-0x000000000058C000-0x0000000000625000-memory.dmp
-
memory/3960-143-0x000001E0B58E0000-0x000001E0B58E4000-memory.dmp
-
memory/3960-136-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-133-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-132-0x0000000000400000-0x0000000000626000-memory.dmp
-
memory/3960-130-0x0000000000400000-0x0000000000626000-memory.dmp