Analysis
-
max time kernel
159s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2024 10:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe
-
Size
6.8MB
-
MD5
4efd0092742eda7108fce596b9ec349c
-
SHA1
ca52efc5be01f157d4c4fb5adf3e7647be85112c
-
SHA256
5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7
-
SHA512
007d2785fa87203f61fe93f6700ff9367075c8c72a23d187d1bcbea2e13c194b24afa6891759a4453eb756232d0f70dc4f49b8f342cf0c7f3b91641489d4e55f
-
SSDEEP
196608:+sZ3W2FGVcg35nAjMsd5ITPvXe3DuiRuUKP/Eg+k5HePy6vEwo:+8W2FGVcg35nAjMsd56XeTPRuUeH+k5j
Malware Config
Signatures
-
XMRig Miner payload 20 IoCs
resource yara_rule behavioral2/memory/1672-2-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-3-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-4-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-5-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-6-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-7-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-8-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-9-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-11-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-13-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-14-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-15-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-16-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-17-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-18-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-19-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-21-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-22-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-23-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral2/memory/1672-24-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2972 set thread context of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe 1672 nslookup.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1672 nslookup.exe Token: SeLockMemoryPrivilege 1672 nslookup.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94 PID 2972 wrote to memory of 1672 2972 5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe"C:\Users\Admin\AppData\Local\Temp\5a64166467fc5da07d416fec7fd64177b76e8b8ca88d12490a8ca6d0051eada7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672
-