Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 06:41
Behavioral task
behavioral1
Sample
114db0775592ad5b6f570c3925e95a4c.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
114db0775592ad5b6f570c3925e95a4c.exe
-
Size
784KB
-
MD5
114db0775592ad5b6f570c3925e95a4c
-
SHA1
6fa89c3f345007bf07a12b743b10e7e3120f5667
-
SHA256
31f0531f3d3a9b0a4b3c405cca434c532b3be71675c04d8580c81712b4c11dba
-
SHA512
6922157ab0e7429d798cde936af13f98deaa1715c0348d727a09059fd4b64f0a4fe44938bd8252ab99a2b9aba281fd854597aec86d4f1fd9159170783a76b102
-
SSDEEP
24576:u4VPDiiEDuWsnlw9gVeDjh8Pg1gXcII24Lqfr:rPual0+eD4jDI6
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/3000-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3000-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3552-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/3552-22-0x0000000005450000-0x00000000055E3000-memory.dmp xmrig behavioral2/memory/3552-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/3552-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 3552 114db0775592ad5b6f570c3925e95a4c.exe -
Executes dropped EXE 1 IoCs
pid Process 3552 114db0775592ad5b6f570c3925e95a4c.exe -
resource yara_rule behavioral2/memory/3000-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/memory/3552-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3000 114db0775592ad5b6f570c3925e95a4c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3000 114db0775592ad5b6f570c3925e95a4c.exe 3552 114db0775592ad5b6f570c3925e95a4c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3552 3000 114db0775592ad5b6f570c3925e95a4c.exe 23 PID 3000 wrote to memory of 3552 3000 114db0775592ad5b6f570c3925e95a4c.exe 23 PID 3000 wrote to memory of 3552 3000 114db0775592ad5b6f570c3925e95a4c.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\114db0775592ad5b6f570c3925e95a4c.exe"C:\Users\Admin\AppData\Local\Temp\114db0775592ad5b6f570c3925e95a4c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\114db0775592ad5b6f570c3925e95a4c.exeC:\Users\Admin\AppData\Local\Temp\114db0775592ad5b6f570c3925e95a4c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3552
-