Analysis

  • max time kernel
    143s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 16:46

General

  • Target

    f7cb0e8c6e055469803c76d59a6f77d8.exe

  • Size

    784KB

  • MD5

    f7cb0e8c6e055469803c76d59a6f77d8

  • SHA1

    b992e6d9ad0ad93e3ca62a9df09e70e8e08928d0

  • SHA256

    d601d3cbae466945df780bf0d48d6800d54ef58ab2330ce866df585cd8e6d063

  • SHA512

    9f3cd460ce22b537737633dd27dce4f63fb46608f1cc711444466a2613affcd80cbf24c6bb1b8ab7cafe151b380f3b4b47b6cc0dae85bd5ceff54e2d8df9aeb9

  • SSDEEP

    12288:4w9roMj2kwtMus9MjRC+h/6DpfWVqjs/ev2QDFk8V0dG6hwfXlAdGl2nuF56sPo7:4MjSJ9CcwvwTQDaZdG6gknuFlPo5ATq

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 6 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe
    "C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe
      C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\f7cb0e8c6e055469803c76d59a6f77d8.exe

    Filesize

    181KB

    MD5

    cb0e04470d902d153d6aa45b26c8a45c

    SHA1

    be1041a54ea4592c26197651e643698331a0f0db

    SHA256

    a5f22b6cdfdcf9db6b0dadd19679855c52d75ba46caa82970fef10ef3581925e

    SHA512

    a2a922048010bfaaa92f0495fd417e7f71207420bc4f8144c57f747e94d1b0bc39b657b9b8a3d56e03b971abd15f23e693365537369139b671f1d789da427634

  • memory/2224-13-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/2224-14-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/2224-16-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/2224-20-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/2224-21-0x0000000005520000-0x00000000056B3000-memory.dmp

    Filesize

    1.6MB

  • memory/2224-30-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/4388-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/4388-1-0x0000000001720000-0x00000000017E4000-memory.dmp

    Filesize

    784KB

  • memory/4388-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/4388-12-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB