Analysis
-
max time kernel
147s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 10:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe
-
Size
6.8MB
-
MD5
4efd0092742eda7108fce596b9ec349c
-
SHA1
ca52efc5be01f157d4c4fb5adf3e7647be85112c
-
SHA256
5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7
-
SHA512
007d2785fa87203f61fe93f6700ff9367075c8c72a23d187d1bcbea2e13c194b24afa6891759a4453eb756232d0f70dc4f49b8f342cf0c7f3b91641489d4e55f
-
SSDEEP
196608:+sZ3W2FGVcg35nAjMsd5ITPvXe3DuiRuUKP/Eg+k5HePy6vEwo:+8W2FGVcg35nAjMsd56XeTPRuUeH+k5j
Malware Config
Signatures
-
XMRig Miner payload 16 IoCs
resource yara_rule behavioral1/memory/2364-2-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-3-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-4-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-5-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-6-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-7-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-8-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-9-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-11-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-13-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-15-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-14-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-16-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-17-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-18-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2364-19-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2544 set thread context of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe 2364 nslookup.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2364 nslookup.exe Token: SeLockMemoryPrivilege 2364 nslookup.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30 PID 2544 wrote to memory of 2364 2544 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe"C:\Users\Admin\AppData\Local\Temp\5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364
-