Overview
overview
10Static
static
10xm.gz
windows7-x64
3xm.gz
windows10-2004-x64
7sample.tar
windows7-x64
3sample.tar
windows10-2004-x64
7aarch64
ubuntu-18.04-amd64
6create
ubuntu-18.04-amd64
7create
debian-9-armhf
7create
debian-9-mips
1create
debian-9-mipsel
1hide
ubuntu-18.04-amd64
1hide.c
windows7-x64
3hide.c
windows10-2004-x64
3init
ubuntu-18.04-amd64
3mining
ubuntu-18.04-amd64
6mining
debian-9-armhf
6mining
debian-9-mips
6mining
debian-9-mipsel
6mkcfg
ubuntu-18.04-amd64
1mkcfg
debian-9-armhf
1mkcfg
debian-9-mips
1mkcfg
debian-9-mipsel
1start
ubuntu-18.04-amd64
10start
debian-9-armhf
1start
debian-9-mips
1start
debian-9-mipsel
1x86_64
ubuntu-18.04-amd64
6Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/12/2023, 05:19
Behavioral task
behavioral1
Sample
xm.gz
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
xm.gz
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
sample.tar
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
sample.tar
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
aarch64
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral6
Sample
create
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral7
Sample
create
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral8
Sample
create
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral9
Sample
create
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral10
Sample
hide
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral11
Sample
hide.c
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
hide.c
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
init
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral14
Sample
mining
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral15
Sample
mining
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral16
Sample
mining
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral17
Sample
mining
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral18
Sample
mkcfg
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral19
Sample
mkcfg
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral20
Sample
mkcfg
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral21
Sample
mkcfg
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral22
Sample
start
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral23
Sample
start
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral24
Sample
start
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral25
Sample
start
Resource
debian9-mipsel-20231215-en
Behavioral task
behavioral26
Sample
x86_64
Resource
ubuntu1804-amd64-20231215-en
General
-
Target
xm.gz
-
Size
3.9MB
-
MD5
1371a2ca243dc0cd5fae198d69f44708
-
SHA1
f7921b63d2b3f7587f192a5708e339e6a9b1f2f6
-
SHA256
13607684da4fc4c2493996ff4ffe2347a806cb13b905d97bec815d5bf33824da
-
SHA512
84aa7f461c8ebcdd5434f6be119217b9a51ea08c46b0b1ae1e9f0f4081dd77364c552beab8511719b8727972c46c25ab8769faccd65f8b21d6d591ee7a7d4b13
-
SSDEEP
98304:EtPSdi6EM62kXoADzDtDSyKSgXBesozngrcLFoZYWjiDRUPGD:EtFMXQoAf5DNgXksoPFoC+idvD
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2740 7zFM.exe Token: 35 2740 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2740 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2740 2628 cmd.exe 29 PID 2628 wrote to memory of 2740 2628 cmd.exe 29 PID 2628 wrote to memory of 2740 2628 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\xm.gz1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\xm.gz"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2740
-