Overview

overview

10

Static

static

b01ddbf0bf...6f.exe

windows7-x64

10

b01ddbf0bf...6f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-09-2022 09:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b01ddbf0bff46769347ba59495c22c6f.exe

  • Size

    3.4MB

  • MD5

    b01ddbf0bff46769347ba59495c22c6f

  • SHA1

    36bb6a7d67ebffb8dc2c903d20594141436de37e

  • SHA256

    6622ecf695d6546c9ce99134a13c485d33691905b4140ca5fbe6d704948cf651

  • SHA512

    6f05570e01fcf9511626cd7d85bc20a32ebd7d9fdd49b52de80ee4ec20fb3f34880a07d0758543630c02b93484e501824a4f0df3bebf6c9b30fb24fc87f16f96

  • SSDEEP

    98304:Mh0ywRz70/W9+68ZBtKe3oWFGNc+sA5loQwMEp+ou/Xf:nyf/W9+DfFGNv5lnEMosf

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 63 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3080
      • C:\Users\Admin\AppData\Local\Temp\b01ddbf0bff46769347ba59495c22c6f.exe
        "C:\Users\Admin\AppData\Local\Temp\b01ddbf0bff46769347ba59495c22c6f.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3812
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Windows\system32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4284
        • C:\Windows\system32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3452
        • C:\Windows\system32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
        • C:\Windows\system32\powercfg.exe
          powercfg /x -standby-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3584
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic PATH Win32_VideoController GET Name, VideoProcessor
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2500
      • C:\Windows\system32\dwm.exe
        C:\Windows\system32\dwm.exe ilomnyjxaqxbdyoj 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUOWlLosYbrY2pwtQQU1JTuikNmZuGmV+6BbKlyKFD6zdAaaNcQqky2iJHSWRIHnss9X/nab3QoNVM/Ta0kPMjvUxJH02YjP5XrdviLouahJX3Q1zD8omsKRft5FC/3aHRX5nzuLKj6v+l1hD7RDcnRlZOinraqnGRmc1rfZVBSryXdWQXUdRaex46bFg0DdbEVFMZ4l0pshLxALGam+crSqgmoA+SAgVTiLqPU5NWi5uz8p9/Px4ZVwH3rGiyQeauAdOPHdWjMSLjdPXQwzIiHwOAjFFE5CqTkW9rgSKBlevE7bTasEexce14S+TdxAbNPSrsW2DMq8LcazEG7sh428X1gT4o5W2jpf5fY/EMDWCsJla29dmLn/CAr49BWQFG1/pwNMU6xh2tqJf8WnFCSEU3eXDu2G8zQ9IwK7MpQkB1D9krTLyt7WoPvOZQOh0lkfSckQ6jxQVRjaMclifx2Mi/zUH96ZVLzydQh6xfv78=
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4920

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Google\Libs\g.log
      Filesize

      226B

      MD5

      fdba80d4081c28c65e32fff246dc46cb

      SHA1

      74f809dedd1fc46a3a63ac9904c80f0b817b3686

      SHA256

      b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

      SHA512

      b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

      Download Submit
    • memory/2500-133-0x0000000000000000-mapping.dmp
      Download
    • memory/3452-134-0x0000000000000000-mapping.dmp
      Download
    • memory/3548-136-0x0000000000000000-mapping.dmp
      Download
    • memory/4284-132-0x0000000000000000-mapping.dmp
      Download
    • memory/4584-135-0x0000000000000000-mapping.dmp
      Download
    • memory/4920-138-0x00007FF74C8A2120-mapping.dmp
      Download
    • memory/4920-139-0x00007FF74C0B0000-0x00007FF74C8A4000-memory.dmp
      Filesize

      8.0MB

      Download
    • memory/4920-140-0x000001D1BBDE0000-0x000001D1BBE00000-memory.dmp
      Filesize

      128KB

      Download
    • memory/4920-141-0x000001D1BBFF0000-0x000001D1BC030000-memory.dmp
      Filesize

      256KB

      Download
    • memory/4920-142-0x00007FF74C0B0000-0x00007FF74C8A4000-memory.dmp
      Filesize

      8.0MB

      Download
    • memory/4920-143-0x000001D1BC080000-0x000001D1BC0A0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/4920-144-0x000001D1BC080000-0x000001D1BC0A0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/4920-145-0x000001D1BC080000-0x000001D1BC0A0000-memory.dmp
      Filesize

      128KB

      Download
    • memory/4920-146-0x000001D1BC0B0000-0x000001D1BC0D0000-memory.dmp
      Filesize

      128KB

      Download