Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 04:33
Behavioral task
behavioral1
Sample
285392875d65770426ae4855940d4292.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
-
Target
285392875d65770426ae4855940d4292.exe
-
Size
784KB
-
MD5
285392875d65770426ae4855940d4292
-
SHA1
ae1c051ca9e78d84abf90d36873796b152eddb46
-
SHA256
d6b25771183dbf9f2597d4261db4cd1fb7831785cb720dbc14c832489de245ce
-
SHA512
3f71c80d91116eda23cc7d6980aba93bbd8e56a1ced4c0c1d5cafd1ffc04e1ae8d7b9e67334d2a0258c698a8b58dfb3153f6e78f8f08f99dd7004f1e3482a027
-
SSDEEP
12288:wZPy043VnNjUaCyDCqK1tSe1Iyc0MhfLH+pBYFBgw6CabgMNoh8Ht2hSPfFyhtNW:pXjOyD3K1tSgQ+vguCcNohWIwNyhzv
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/1912-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1248-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1248-21-0x00000000053E0000-0x0000000005573000-memory.dmp xmrig behavioral2/memory/1248-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1248-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1912-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1248 285392875d65770426ae4855940d4292.exe -
Executes dropped EXE 1 IoCs
pid Process 1248 285392875d65770426ae4855940d4292.exe -
resource yara_rule behavioral2/memory/1912-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/memory/1248-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1912 285392875d65770426ae4855940d4292.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1912 285392875d65770426ae4855940d4292.exe 1248 285392875d65770426ae4855940d4292.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1912 wrote to memory of 1248 1912 285392875d65770426ae4855940d4292.exe 22 PID 1912 wrote to memory of 1248 1912 285392875d65770426ae4855940d4292.exe 22 PID 1912 wrote to memory of 1248 1912 285392875d65770426ae4855940d4292.exe 22
Processes
-
C:\Users\Admin\AppData\Local\Temp\285392875d65770426ae4855940d4292.exe"C:\Users\Admin\AppData\Local\Temp\285392875d65770426ae4855940d4292.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\285392875d65770426ae4855940d4292.exeC:\Users\Admin\AppData\Local\Temp\285392875d65770426ae4855940d4292.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1248
-