Analysis

  • max time kernel
    169s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 04:29

General

  • Target

    283019e3b6a05e02374d815d85e39a08.exe

  • Size

    784KB

  • MD5

    283019e3b6a05e02374d815d85e39a08

  • SHA1

    79fa3abf7713e7559a687a54dda3498d565ed77d

  • SHA256

    5965844b40f536a7ef45f0d22399f362e56efb58ce6fdc3e913511475f46a955

  • SHA512

    472edc8f642fd25e10246e014b420ba6f66049f54ed37be4e8459cc7ba8c58a4bcb7c1927013ac1a5612c694b2c5737d1108c5b8b4c7992b1f5073b82644c1ad

  • SSDEEP

    24576:MCXzdrmJqtF2p1x/B8kX9pGRr3UHVFxZ:M8tmK2p1YEp4kHXxZ

Score
10/10

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\283019e3b6a05e02374d815d85e39a08.exe
    "C:\Users\Admin\AppData\Local\Temp\283019e3b6a05e02374d815d85e39a08.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Users\Admin\AppData\Local\Temp\283019e3b6a05e02374d815d85e39a08.exe
      C:\Users\Admin\AppData\Local\Temp\283019e3b6a05e02374d815d85e39a08.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\283019e3b6a05e02374d815d85e39a08.exe

    Filesize

    119KB

    MD5

    f283979e5faef69d46db8003a6d4c0a8

    SHA1

    aba36e892957f45929904e63cffa8d58758582f5

    SHA256

    b5cbb7c387e39f5e3ac9db2a5dfcd63d8e7ca6fb3801b643689d3ae1a48dbcb1

    SHA512

    0e5b0d9dd397bdaa28b24696f346149363cc3687e9c095f0f9ea2bd14cb9dd569738422e15878b639fd6c1b3f0b6bb68ef1b75396dec4f1b0feced18597ba271

  • memory/1504-0-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/1504-1-0x00000000019B0000-0x0000000001A74000-memory.dmp

    Filesize

    784KB

  • memory/1504-2-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/1504-13-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/4196-14-0x0000000000400000-0x0000000000712000-memory.dmp

    Filesize

    3.1MB

  • memory/4196-15-0x0000000000400000-0x0000000000593000-memory.dmp

    Filesize

    1.6MB

  • memory/4196-17-0x0000000001B30000-0x0000000001BF4000-memory.dmp

    Filesize

    784KB

  • memory/4196-21-0x00000000053A0000-0x0000000005533000-memory.dmp

    Filesize

    1.6MB

  • memory/4196-22-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/4196-32-0x0000000000400000-0x0000000000587000-memory.dmp

    Filesize

    1.5MB

  • memory/4196-31-0x00000000005A0000-0x000000000071F000-memory.dmp

    Filesize

    1.5MB