Analysis
-
max time kernel
91s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2022, 17:06
Static task
static1
Behavioral task
behavioral1
Sample
8ceea3c19dd757165fc4a7597fb9f682.exe
Resource
win7-20221111-en
4 signatures
150 seconds
General
-
Target
8ceea3c19dd757165fc4a7597fb9f682.exe
-
Size
5.1MB
-
MD5
8ceea3c19dd757165fc4a7597fb9f682
-
SHA1
d6bd4125d0a7fa22b6edf691d124569d2441c58e
-
SHA256
71a7c75802852bc47630846ce55c037faba06b17035b93ba3bec6538579f3dcd
-
SHA512
77808caf9d40b8e7769dadaac2951e8158df105c98e710f048adaaf2d00d7cb8ace12306f5684f4f456e43be5ec76796d8cc21e7adaef741b2d90d823b3ebbd6
-
SSDEEP
98304:gkOBER7wfiWcNKahSgMk8miYFTG7vLEASMdwu+OAxCAJn9pB964:gkOBy14gXpivLEwz2E4
Malware Config
Signatures
-
XMRig Miner payload 5 IoCs
resource yara_rule behavioral2/memory/3944-132-0x00007FF70A400000-0x00007FF70B88D000-memory.dmp xmrig behavioral2/memory/3944-135-0x00007FF70A400000-0x00007FF70B88D000-memory.dmp xmrig behavioral2/memory/3944-136-0x00007FF70A400000-0x00007FF70B88D000-memory.dmp xmrig behavioral2/memory/3944-137-0x00007FF70A400000-0x00007FF70B88D000-memory.dmp xmrig behavioral2/memory/3944-139-0x00007FF70A400000-0x00007FF70B88D000-memory.dmp xmrig -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3944 8ceea3c19dd757165fc4a7597fb9f682.exe 3944 8ceea3c19dd757165fc4a7597fb9f682.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3944 8ceea3c19dd757165fc4a7597fb9f682.exe 3944 8ceea3c19dd757165fc4a7597fb9f682.exe 3944 8ceea3c19dd757165fc4a7597fb9f682.exe 3944 8ceea3c19dd757165fc4a7597fb9f682.exe 3944 8ceea3c19dd757165fc4a7597fb9f682.exe 3944 8ceea3c19dd757165fc4a7597fb9f682.exe