Analysis
-
max time kernel
1800s -
max time network
1802s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2023, 23:28
Static task
static1
1 signatures
General
-
Target
zx.exe
-
Size
5.4MB
-
MD5
00ddee7f37fc5e215a882fc4087dbddc
-
SHA1
d037493f7241be289fe2bda32463fce91fe1b0ba
-
SHA256
ee29c2f2024806574391a1da48d9e38575cc93f9cbf57c9778e0e9bd7af5c45b
-
SHA512
ea8d2690bd262f7e31491851fad63f1df02e7c898d27b4b6cc17a91862b7209ad198c91793d30370c9a6f0d5c6c46105c4a2b43a9794091b9bff9f089fc48f2b
-
SSDEEP
98304:JSsnkpppRTS1x+fxxPC1NiUySli0QRG3GybVfxSM:J5nwpzgx+5s1MBYQY3Gyhfx
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4436 created 3220 4436 zx.exe 55 -
XMRig Miner payload 52 IoCs
resource yara_rule behavioral1/memory/4436-136-0x00007FF701A10000-0x00007FF701F85000-memory.dmp xmrig behavioral1/memory/4488-139-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-155-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-158-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-159-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-160-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-161-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-162-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-163-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-164-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-165-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-166-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-167-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-168-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-169-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-170-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-171-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-172-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-173-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-174-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-175-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-176-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-177-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-178-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-179-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-180-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-181-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-182-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-183-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-184-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-185-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-186-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-187-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-188-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-193-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-194-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-195-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-196-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-197-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-198-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-199-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-200-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-201-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-202-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-203-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-204-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-205-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-206-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-207-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-208-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-209-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig behavioral1/memory/4488-214-0x00007FF70BAF0000-0x00007FF70C2DF000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4436 set thread context of 4488 4436 zx.exe 98 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 4436 zx.exe 4436 zx.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeLockMemoryPrivilege 4488 explorer.exe Token: SeLockMemoryPrivilege 4488 explorer.exe Token: SeDebugPrivilege 3680 taskmgr.exe Token: SeSystemProfilePrivilege 3680 taskmgr.exe Token: SeCreateGlobalPrivilege 3680 taskmgr.exe Token: 33 3680 taskmgr.exe Token: SeIncBasePriorityPrivilege 3680 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 3680 taskmgr.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe 4488 explorer.exe -
Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4436 wrote to memory of 4488 4436 zx.exe 98
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\zx.exe"C:\Users\Admin\AppData\Local\Temp\zx.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4436
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4488
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3680
-