Analysis
-
max time kernel
143s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 15:43
General
-
Target
de8015cb70b3905f844de2eb5862c88f.exe
-
Size
1.5MB
-
MD5
de8015cb70b3905f844de2eb5862c88f
-
SHA1
30303b55752740ba0936fa3ee19f839281ef2d89
-
SHA256
e50dad3efb07f35eeedab3687a06c9180de5dc1ee51a6bc08d5dc9a21ad518f1
-
SHA512
0019f16c772e85335b70917af1382135aee38074d66057ddf7f3661e7cc3d5385637a47a56d762b6583d52c99baf0a45d2f3cfb7aeb30ece6a4aaa62c0340523
-
SSDEEP
24576:SNLdIQNrQJpX2Z88SBiS2nIOmgVd3O9CvpeD/Hw44e9xPkri:SNLdfQ/X2mMSv9w+9CRe7QteXG
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 6 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\de8015cb70b3905f844de2eb5862c88f.exe"C:\Users\Admin\AppData\Local\Temp\de8015cb70b3905f844de2eb5862c88f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de8015cb70b3905f844de2eb5862c88f.exeC:\Users\Admin\AppData\Local\Temp\de8015cb70b3905f844de2eb5862c88f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
784KB
-
Filesize
1.6MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
784KB
-
Filesize
1.6MB
-
Filesize
1.6MB