Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2022, 07:38
Static task
static1
Behavioral task
behavioral1
Sample
10bb8c29f65868b36a454c722ae01969.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
General
-
Target
10bb8c29f65868b36a454c722ae01969.exe
-
Size
4.1MB
-
MD5
10bb8c29f65868b36a454c722ae01969
-
SHA1
5b68e0d3e170207b04b96eb23a4f67620cba0170
-
SHA256
68984f5ac7696cc5398c6b9912770041953b3d7bb1f92cd16854b5a0db1955bc
-
SHA512
0393cac3516e173f66cf8430c1b1c2216a677f714e102db25a6c0c39003fbd65d137d73a6756017cd1e7846d1fd3e4c7f4631f2d5e8d2f7a61baa59536b72540
-
SSDEEP
98304:N4OyiLwkUPYwyuZXPklUrQj3AZBKMisGmiNX1bsUtS1r4xM0/o:NbNLw1PrZ/bsbUmCQX3tSqA
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/3004-135-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3004-136-0x000000014036EAC4-mapping.dmp xmrig behavioral2/memory/3004-137-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3004-139-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3004-141-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/3004-143-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4872 set thread context of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 644 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3004 explorer.exe Token: SeLockMemoryPrivilege 3004 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe 3004 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83 PID 4872 wrote to memory of 3004 4872 10bb8c29f65868b36a454c722ae01969.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\10bb8c29f65868b36a454c722ae01969.exe"C:\Users\Admin\AppData\Local\Temp\10bb8c29f65868b36a454c722ae01969.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\explorer.exeC:\Windows\explorer.exe pcuxkibwfapwhvzm1 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUOWlLosYbrY2pwtQQU1JTuikNmZuGmV+6BbKlyKFD6zdAaaNcQqky2iJHSWRIHnss9X/nab3QoNVM/Ta0kPMjvUxJH02YjP5XrdviLouahJX3Q1zD8omsKRft5FC/3aHRX5nzuLKj6v+l1hD7RDcnRlZOinraqnGRmc1rfZVBSryXdWQXUdRaex46bFg0DdbEVFMZ4l0pshLxALGam+crSqgmoA+SAgVTiLqPU5NWi5uz8p9/Px4ZVwH3rGiyQeauAdOPHdWjMSLjdPXQwzIiHwOAjFFE5CqTkW9rgSKBlevE7bTasEexce14S+TdxAbNPSrsW2DMq8LcazEG7sh428X1gT4o5W2jpf5fY/EMDWD9CKIkKRoLtfFe70OaU67cjMAYIj/AZI0xT94JqMRUWgt/sbZu8yCnNnxa9lrrvg2H53pbs3LI7hr+EUbmTQCoqVrW0bwsGKA92LClZBPI4vmpqpgf5KmusPiS52e3rU0=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3004
-