Overview

overview

10

Static

static

7

7766c0556c...77.exe

windows7-x64

10

7766c0556c...77.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 07:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7766c0556c13d02448982c5fd1088c77.exe

  • Size

    1.5MB

  • MD5

    7766c0556c13d02448982c5fd1088c77

  • SHA1

    ac4f61c45db457c7796738bbfbc959adab2bdfb0

  • SHA256

    57077c8949fbdf3b8d6165fae9d00bf6fab54acf1987a3388c07edcf5eff91ab

  • SHA512

    2feeb622f8563cfe497270888f8ebce64db35f294b243f0eaa5085a5df9b3829a9a3a2fc380e402a5005f9db642d85b5e43da780803315cb4decea29b52adb03

  • SSDEEP

    49152:wZildEkBYwfAlfhtr6UBuy9Y5p2XfwVTIynyjc+rGc/l:wZildjYwYvtr6s8QXCIyyjc+qk

Score
10/10
xmrigminerupx

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 6 IoCs
    miner
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7766c0556c13d02448982c5fd1088c77.exe
    "C:\Users\Admin\AppData\Local\Temp\7766c0556c13d02448982c5fd1088c77.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\7766c0556c13d02448982c5fd1088c77.exe
      C:\Users\Admin\AppData\Local\Temp\7766c0556c13d02448982c5fd1088c77.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4396

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7766c0556c13d02448982c5fd1088c77.exe
          Filesize

          162KB

          MD5

          cc5d6f09c14013f3546f9d8f7c18017b

          SHA1

          2723a056e379e8778bd027c3b5b2798f6d448561

          SHA256

          a252bdd3258c7f741ef00c6ac95cf4554998be0ab921bac96d73f8f1ab07d41a

          SHA512

          5e417016d4d344b4bcd6009c7f325bca2cfa531b87d6786b5f53c8e0dfae97ace7d69df3fe6955a7a9f144b344eea7ddc661ba40132b21494a78e0f9947dd27e

          Download Submit

        • memory/4396-13-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/4396-15-0x0000000001720000-0x00000000017E4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/4396-14-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/4396-21-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/4396-20-0x00000000053D0000-0x0000000005563000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/4396-30-0x0000000000400000-0x0000000000587000-memory.dmp

          Filesize

          1.5MB

          Download

        • memory/4968-0-0x0000000000400000-0x0000000000712000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/4968-1-0x0000000001720000-0x00000000017E4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/4968-2-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download

        • memory/4968-12-0x0000000000400000-0x0000000000593000-memory.dmp

          Filesize

          1.6MB

          Download