Analysis
-
max time kernel
3s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-12-2023 00:38
General
-
Target
46f142ec4f1558f8f9c1fa21ea537a18.exe
-
Size
22.3MB
-
MD5
46f142ec4f1558f8f9c1fa21ea537a18
-
SHA1
3432b472d77ab23eaeb84d8a1216760026ea2bed
-
SHA256
ccc2ea5c6c77c63d946aa879fba1c0ecdf1012579663fa0c5cf685321c4e2bdc
-
SHA512
2f91404aea498853b43fc55afaf2d9de0f9fa590a99b370e36b7685bfb7a175e9c54458ba9de0b90e9aed4f22218032af77b77697584be26ac9fe349a2e9634e
-
SSDEEP
393216:KNeT0wtyhnylmtmtIslCRk2TdGAUae9Sp18eNdU6yxqZGeeV4QduZKLNY/FTuB2F:qXylAdVu9SpyhxeQVa0NY/FawO
Malware Config
Signatures
-
XMRig Miner payload 5 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46f142ec4f1558f8f9c1fa21ea537a18.exe"C:\Users\Admin\AppData\Local\Temp\46f142ec4f1558f8f9c1fa21ea537a18.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\xmrig.exe"C:\Users\Admin\AppData\Roaming\xmrig.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD55b01e7a62a4828599c62c99d83462582
SHA12ad7a9e5ac3d25b9d062528fcdac4910924ee4fa
SHA256f16b671a32501cf730c618dd4ab7f7df3a5ce0a1c92c7919455b35d21c398dbf
SHA512846a3d1c8794916a75290f338aa35f6ed6edf5ea3ef0560e032bb2848a371bf1e1c775a90254c987c531439a770a7385a967253f48108408b8935adb8d27d811
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
41.6MB
-
Filesize
22.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB