Analysis
-
max time kernel
147s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 19:10
Behavioral task
behavioral1
Sample
3769bce546c62f2f74e90adfebdaad99.exe
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
3769bce546c62f2f74e90adfebdaad99.exe
-
Size
784KB
-
MD5
3769bce546c62f2f74e90adfebdaad99
-
SHA1
80d2f816a4ffa9ecd8cb420eb543a9268b41e328
-
SHA256
31c786fdb8ec2506f63a5c34dee0e9fb5726c8b0a02fdaf8c0b84ec297f88282
-
SHA512
921b4ceaeaac622e9d25f5ecbe69a4a6751ea863b7ea96a71ee456d2ee497defc6f9f924c42e1109374bbda3210ac09a5037af5b5f43af1a745f845704b55656
-
SSDEEP
12288:uqSV3JEY+Xy96UPI2z6324NHcLecHGsDwDoKGIP2El3LXIlJYH7Zsp5:uqSzEYZI7flNcVLDwEKGIP2E5LX0W7i
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/1004-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/5016-21-0x00000000053F0000-0x0000000005583000-memory.dmp xmrig behavioral2/memory/5016-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/5016-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/5016-14-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/1004-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 5016 3769bce546c62f2f74e90adfebdaad99.exe -
Executes dropped EXE 1 IoCs
pid Process 5016 3769bce546c62f2f74e90adfebdaad99.exe -
resource yara_rule behavioral2/memory/1004-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/memory/5016-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1004 3769bce546c62f2f74e90adfebdaad99.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1004 3769bce546c62f2f74e90adfebdaad99.exe 5016 3769bce546c62f2f74e90adfebdaad99.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1004 wrote to memory of 5016 1004 3769bce546c62f2f74e90adfebdaad99.exe 19 PID 1004 wrote to memory of 5016 1004 3769bce546c62f2f74e90adfebdaad99.exe 19 PID 1004 wrote to memory of 5016 1004 3769bce546c62f2f74e90adfebdaad99.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\3769bce546c62f2f74e90adfebdaad99.exe"C:\Users\Admin\AppData\Local\Temp\3769bce546c62f2f74e90adfebdaad99.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3769bce546c62f2f74e90adfebdaad99.exeC:\Users\Admin\AppData\Local\Temp\3769bce546c62f2f74e90adfebdaad99.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:5016
-