General
-
Target
84382642ae4a3aexeexeexeex.exe
-
Size
13.6MB
-
Sample
230709-xvxmmsfc58
-
MD5
00a31cee2d0c39551187af784b5c255d
-
SHA1
d9cd2725c7a1305fa66d5eaf9c03c5d44c5ec3d4
-
SHA256
d4e4d3bd21995cebdc984e4d02a4abcefe5e8e98f5caaa2166230d5f746858bd
-
SHA512
5e98224e95d98888929368e412e7cebd12dcefa6d473b0fadc647aad77bd6eb19148d2b74edd75ba0804b70d4b433585131d7e95896a9fad9d89355126f07451
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Behavioral task
behavioral1
Sample
84382642ae4a3aexeexeexeex.exe
Resource
win7-20230703-en
Malware Config
Targets
-
-
Target
84382642ae4a3aexeexeexeex.exe
-
Size
13.6MB
-
MD5
00a31cee2d0c39551187af784b5c255d
-
SHA1
d9cd2725c7a1305fa66d5eaf9c03c5d44c5ec3d4
-
SHA256
d4e4d3bd21995cebdc984e4d02a4abcefe5e8e98f5caaa2166230d5f746858bd
-
SHA512
5e98224e95d98888929368e412e7cebd12dcefa6d473b0fadc647aad77bd6eb19148d2b74edd75ba0804b70d4b433585131d7e95896a9fad9d89355126f07451
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Contacts a large (47240) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
mimikatz is an open source tool to dump credentials on Windows
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Sets file execution options in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a Windows Service
-
Drops file in System32 directory
-