Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 15:13
Behavioral task
behavioral1
Sample
4bc47edd531cd8265c13c48a0484ef85.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
4bc47edd531cd8265c13c48a0484ef85.exe
-
Size
784KB
-
MD5
4bc47edd531cd8265c13c48a0484ef85
-
SHA1
58a2e608858758906fbde0059766f863de01775a
-
SHA256
615819dccdbb66a98bb9c5136d9356fd3fbb8c71ae33916dc3843cebac77ca98
-
SHA512
5046fc9bbcbd408fb3dfc5aa41ba1c05b4331f6c4e4de2369bc773239360c13c2717d74e87de1fb5436ec6d735a921c98599703d7beadf8aceef57fc9f6bf73e
-
SSDEEP
24576:9nqqz0P95d/42H0bQlosaZmWxDp4QUIZHErx:dm42H0bQymW1p4mZ
Malware Config
Signatures
-
XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/memory/2692-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/2692-13-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1696-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1696-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1696-31-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/1696-30-0x00000000005A0000-0x000000000071F000-memory.dmp xmrig behavioral2/memory/1696-20-0x0000000005370000-0x0000000005503000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 1696 4bc47edd531cd8265c13c48a0484ef85.exe -
Executes dropped EXE 1 IoCs
pid Process 1696 4bc47edd531cd8265c13c48a0484ef85.exe -
resource yara_rule behavioral2/memory/2692-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/memory/1696-12-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2692 4bc47edd531cd8265c13c48a0484ef85.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2692 4bc47edd531cd8265c13c48a0484ef85.exe 1696 4bc47edd531cd8265c13c48a0484ef85.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2692 wrote to memory of 1696 2692 4bc47edd531cd8265c13c48a0484ef85.exe 23 PID 2692 wrote to memory of 1696 2692 4bc47edd531cd8265c13c48a0484ef85.exe 23 PID 2692 wrote to memory of 1696 2692 4bc47edd531cd8265c13c48a0484ef85.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bc47edd531cd8265c13c48a0484ef85.exe"C:\Users\Admin\AppData\Local\Temp\4bc47edd531cd8265c13c48a0484ef85.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4bc47edd531cd8265c13c48a0484ef85.exeC:\Users\Admin\AppData\Local\Temp\4bc47edd531cd8265c13c48a0484ef85.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1696
-