General
-
Target
942b7ac3cfb48cexeexeexeex.exe
-
Size
12.7MB
-
Sample
230709-xxgn7sfc99
-
MD5
942b7ac3cfb48c7abf9338ca56078138
-
SHA1
c300976d308c55cbf72e71288d36f154ebf85688
-
SHA256
63a1607c66c286f6e9615cff830e7a7986fa646b3ea9a30be21947c3341a6131
-
SHA512
91ca48a05eedade80177b78bc9447362ac4b5141c81ead191577c04ae792d3c69edbda6be991c769d56437a450ba9259ab0c7f88f23b8e71584107b3a3ad3104
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Behavioral task
behavioral1
Sample
942b7ac3cfb48cexeexeexeex.exe
Resource
win7-20230703-en
Malware Config
Targets
-
-
Target
942b7ac3cfb48cexeexeexeex.exe
-
Size
12.7MB
-
MD5
942b7ac3cfb48c7abf9338ca56078138
-
SHA1
c300976d308c55cbf72e71288d36f154ebf85688
-
SHA256
63a1607c66c286f6e9615cff830e7a7986fa646b3ea9a30be21947c3341a6131
-
SHA512
91ca48a05eedade80177b78bc9447362ac4b5141c81ead191577c04ae792d3c69edbda6be991c769d56437a450ba9259ab0c7f88f23b8e71584107b3a3ad3104
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Contacts a large (38671) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
XMRig Miner payload
-
mimikatz is an open source tool to dump credentials on Windows
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Sets file execution options in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a Windows Service
-
Drops file in System32 directory
-