Analysis
-
max time kernel
98s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
15-09-2023 08:36
General
-
Target
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe
-
Size
5.2MB
-
MD5
0e9cc5c2145bae2f6ab41f186dac87d1
-
SHA1
3a495afddc1ed60ecc5c403a6e9dcdc53516ca35
-
SHA256
0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
-
SHA512
76d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
-
SSDEEP
98304:w8ZEl7sMD+0Jz27AoQDu4oI87ozUUG77J6mzRLmvV7FLcVXaR:w4mgMD+0Jz2cDu4e6mzNmthL+C
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 34 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe"C:\Users\Admin\AppData\Local\Temp\0949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\csfogrhbhtai.xml"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5059ccb70dc2c65c81c0dc8bea26a4bb2
SHA109c60376bf998dff186950104a6e7e4f74b37c24
SHA2560b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d
SHA512416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d
-
Filesize
1KB
MD5059ccb70dc2c65c81c0dc8bea26a4bb2
SHA109c60376bf998dff186950104a6e7e4f74b37c24
SHA2560b28be2c63d9b0b5936fb7a5fecbe3dc9bb69de7d212fadaefc03d643bf9482d
SHA512416909daef33f4c55dcd99594b47a2ea65a0fa034179cb206a477d73378b8981eddb2187398e4b121b5448d3643f48033bf131c89d6fbfab3c33f21b8bd42c9d
-
Filesize
5.2MB
MD50e9cc5c2145bae2f6ab41f186dac87d1
SHA13a495afddc1ed60ecc5c403a6e9dcdc53516ca35
SHA2560949ed19896c7add471a5caa7fd5018113d602921a185d911f0cbbadb0ce35c8
SHA51276d46c1d2a126447473d25dae41757a2acf82cb1b79412ae4b887c6f8006515977388f00b8ba5c6162bc8cd3177f465362267402229c82bcd7171509219caccb
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
256KB
-
Filesize
8.2MB
-
Filesize
128KB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
8.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB