Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
170s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 05:32
Behavioral task
behavioral1
Sample
2a21009e2ec33a21b342e44263a267a2.exe
Resource
win7-20231129-en
General
-
Target
2a21009e2ec33a21b342e44263a267a2.exe
-
Size
784KB
-
MD5
2a21009e2ec33a21b342e44263a267a2
-
SHA1
c0c325169e99a463dc31911a10019cb21fc730bd
-
SHA256
3c1657296dbc0b00d33f5670e7bbb2cb924dba9dc57432b924ea29fa811b36f1
-
SHA512
bdec5401b4e56f9c3e8736a8415258e6e549b2e47c46a93f8285870df89e41bfc293f8b24db9381c72ed0f81dba70aee6ab8016358faa384c888960f925f2413
-
SSDEEP
12288:57Ldx/eQSkFEof+TfDfIBWR4M5F1z1qTHqTLncs7ZvzfNwWxFQT2bhTbSQDLvFl7:5bp+Tf8G4UF918HqTzcs7Zpvnrnn
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/1436-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1436-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1760-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1760-20-0x00000000053B0000-0x0000000005543000-memory.dmp xmrig behavioral2/memory/1760-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1760-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1760 2a21009e2ec33a21b342e44263a267a2.exe -
Executes dropped EXE 1 IoCs
pid Process 1760 2a21009e2ec33a21b342e44263a267a2.exe -
resource yara_rule behavioral2/memory/1436-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000500000001e715-11.dat upx behavioral2/memory/1760-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1436 2a21009e2ec33a21b342e44263a267a2.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1436 2a21009e2ec33a21b342e44263a267a2.exe 1760 2a21009e2ec33a21b342e44263a267a2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1760 1436 2a21009e2ec33a21b342e44263a267a2.exe 92 PID 1436 wrote to memory of 1760 1436 2a21009e2ec33a21b342e44263a267a2.exe 92 PID 1436 wrote to memory of 1760 1436 2a21009e2ec33a21b342e44263a267a2.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe"C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exeC:\Users\Admin\AppData\Local\Temp\2a21009e2ec33a21b342e44263a267a2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1760
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5ac6b9325b921bf8f856a592b628c5640
SHA1d1e0838ee71456dc344279e1279ed0bd31b4f293
SHA256a51fdebe6ab52b8e911c9271f71de929b473aeeb270eb62168bb6ce4b7af1793
SHA512bafe29e3f37ea41a3d94cc8041e9d5532df5cf765ebce43e5899a83c7e3b6e018edab6e832be0d39e6c2e18059365e01433cd3661d04bba036eaa116f3ab859a