Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 14:16
Behavioral task
behavioral1
Sample
bd1c36706cfc47d8240c8e7a257c166a.exe
Resource
win7-20231215-en
General
-
Target
bd1c36706cfc47d8240c8e7a257c166a.exe
-
Size
784KB
-
MD5
bd1c36706cfc47d8240c8e7a257c166a
-
SHA1
aea961de8f20b475de061b081458b839d635af1a
-
SHA256
9e5f091aa8f2b09aa78741f007f895adc2d99a83a29a64cba4479a289cbde447
-
SHA512
3c2ffb43f37bad2225c0460771854437e5721abfb557b62dbaec3c18ef280b92457044ea08d439c565d64b06346272d632de1ac42ebc389a84517c6da87e6554
-
SSDEEP
12288:BhBtgPOIBMOTF2Af2VNY0ZWLQmF0pynUQifM70UNTsei1yrjGwX3c5OG5a:PQFDjau0GEpZ2VNIwPG15OG
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/3408-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3408-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/652-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/652-20-0x0000000005450000-0x00000000055E3000-memory.dmp xmrig behavioral2/memory/652-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/652-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 652 bd1c36706cfc47d8240c8e7a257c166a.exe -
Executes dropped EXE 1 IoCs
pid Process 652 bd1c36706cfc47d8240c8e7a257c166a.exe -
resource yara_rule behavioral2/memory/3408-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000700000002321b-11.dat upx behavioral2/memory/652-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3408 bd1c36706cfc47d8240c8e7a257c166a.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3408 bd1c36706cfc47d8240c8e7a257c166a.exe 652 bd1c36706cfc47d8240c8e7a257c166a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 652 3408 bd1c36706cfc47d8240c8e7a257c166a.exe 91 PID 3408 wrote to memory of 652 3408 bd1c36706cfc47d8240c8e7a257c166a.exe 91 PID 3408 wrote to memory of 652 3408 bd1c36706cfc47d8240c8e7a257c166a.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd1c36706cfc47d8240c8e7a257c166a.exe"C:\Users\Admin\AppData\Local\Temp\bd1c36706cfc47d8240c8e7a257c166a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\bd1c36706cfc47d8240c8e7a257c166a.exeC:\Users\Admin\AppData\Local\Temp\bd1c36706cfc47d8240c8e7a257c166a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:652
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
237KB
MD571d56c3f9eca1cd7a3187665d63e5bb9
SHA19d84689ef571f99fe7cd60ced5ee93113d237a99
SHA2569eb64be6c71a5b5014cca473d0d8cb3f54bb8d810b50bb3d34f98f3c13ffb3fc
SHA512d552b9811cadcbfcb7fff3bfe3b8c23665ffe0c7dda9709d30b0936e700b01950b1b05d6bf8b1292e02f5d172dcfe258f6a298645f8461416773f6780274220d