Analysis
- max time kernel
149s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
25/01/2024, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe
- Size 2.0MB
- Sample240125-thrdbabbdm
- SHA256 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad
- MD5 c9f5836878d8edbaa9eb864f5195a5c3
- SHA1 f2703ce36fdc714258221f9e1cf7b9b2c8d33898
- SHA512 00dd50d63017c87b7f828d57524d0d91ab60b5f0c864a26142e161cfef9ccfd6a3a2099bb9b3d39a382fbb345c2075d3f6277d4f825c85dd56f23b31b290a1c7
- SSDEEP 49152:yTxbkIPtWc7c5stBUrHHC4cxyt50WwI3blLRb5Cherbi:g5kIAc7ksturCVK3bNRb5Chmi
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/memory/4032-2-0x0000000000400000-0x0000000000C43000-memory.dmp xmrig behavioral2/memory/4032-3-0x0000000000400000-0x0000000000C43000-memory.dmp xmrig behavioral2/files/0x000700000002320e-11.dat family_xmrig behavioral2/files/0x000700000002320e-11.dat xmrig behavioral2/files/0x000700000002320e-12.dat family_xmrig behavioral2/files/0x000700000002320e-12.dat xmrig behavioral2/memory/4032-16-0x0000000000400000-0x0000000000C43000-memory.dmp xmrig - Executes dropped EXE 1 IoCs
pid Process 4420 sin.dat - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ϵͳ·ÀÓù = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe /I" 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4420 sin.dat Token: SeLockMemoryPrivilege 4420 sin.dat - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4420 sin.dat - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4420 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 92 PID 4032 wrote to memory of 4420 4032 7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe"C:\Users\Admin\AppData\Local\Temp\7b84a9dde57ecaed21008d7c94f547c2691569f32fe96858207ebf8fe65acaad.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\Documents\sin.datC:\Users\Admin\Documents\/sin.dat2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Documents\config.json
- Size 3KB
- SHA256 ffa3750f71d9504ce2c67285e2e1e588828edf37cd12b7cd57d76db26d91f60b
- MD5 9547529a20cd5d10872657bd1171ac5b
- SHA1 869e47f6c8023ae14d92247fcd6f93a3e48f719f
- SHA512 8afb99f3fcc5d54ef8b6dc265f18fe1be3c05910953c13a94fbdfe3c33a4b179628452b7351576c49d98c4dcb73c1ffedf19215b115d8361ed095aa4267bd1c7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\sin.dat
- Size 2.2MB
- SHA256 14f877a877ec0a8b9d14be0440b0f77693c8606c5a3f48fa8e7b7ba584e5c2f1
- MD5 898f0ad69791bef50377471150cb31dc
- SHA1 3293468fe26bbded63509c300ff2e5b186764e4b
- SHA512 4fafa94dcf4aa7e82c174ed72dc28afbaeef313c0ec7b17e8f283ba3a6c7b0e4735fa43217a4a29bde4a69ef956866b5f88bc417b13ffebfc3e3d9ae69eb60fd
- SSDEEP 49152:XJgEN+CI76pT1uO5KvI5fL1pKvQ5pItrR/vsIXC15rtyyszSVpmWp:5pnyiLivQ5pItrR/vsIXC15rPp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\sin.dat
- Size 2.1MB
- SHA256 87fa8c27765ad86b231ccc45ef6fb8db17af9cd77fa2162c768eccad35896180
- MD5 5207ba356e4eef9cb6b3f96351abb667
- SHA1 ff962bd8e249162c479cc1e59f37fef4260a8c98
- SHA512 7c866e53933822fd4bad9575a2ed4adbffa3d85affe03c3ad4a9c33a396a6d49d6d2707f0fb03825805a3509ca011bdb6e102063dc017dffd520d02befe72671
- SSDEEP 49152:XJgEN+CI76pT1uO5KvI5fL1pKvQ5pItrR/vsIXC15rtyyszSVpmD:5pnyiLivQ5pItrR/vsIXC15r8
- MD5 SHA1 SHA512 SSDEEP