Analysis
-
max time kernel
90s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:10
Behavioral task
behavioral1
Sample
74f032309f78c230c748e543d1ff7f52.exe
Resource
win7-20231215-en
General
-
Target
74f032309f78c230c748e543d1ff7f52.exe
-
Size
1.5MB
-
MD5
74f032309f78c230c748e543d1ff7f52
-
SHA1
e716c1929771b17b49f97d06fbf13eb31565c926
-
SHA256
b4d485f471ae03f05ec4a83231ca648026e0fc2690040521d1e5011969bf0065
-
SHA512
b49b048f3acbc7f56c4f9f137b9ab6ed836429be4dd9f083a6e07d53830de6f5bc867d12c363ee89aa4486e82592bbffdd1ffdb1525a120a5853cdba5191dcd7
-
SSDEEP
24576:38cEMvBbFN8jhLhXKu/SGd+rBsqlIm6DK814zChyz3hTucFf9mo+d60sq:ZjfGhLn+BsCIm6utl5nmo+dN
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/384-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/384-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/5080-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/5080-20-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/5080-22-0x0000000005510000-0x00000000056A3000-memory.dmp xmrig behavioral2/memory/5080-30-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
Processes:
74f032309f78c230c748e543d1ff7f52.exepid process 5080 74f032309f78c230c748e543d1ff7f52.exe -
Executes dropped EXE 1 IoCs
Processes:
74f032309f78c230c748e543d1ff7f52.exepid process 5080 74f032309f78c230c748e543d1ff7f52.exe -
Processes:
resource yara_rule behavioral2/memory/384-0-0x0000000000400000-0x0000000000712000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\74f032309f78c230c748e543d1ff7f52.exe upx behavioral2/memory/5080-13-0x0000000000400000-0x0000000000712000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
74f032309f78c230c748e543d1ff7f52.exepid process 384 74f032309f78c230c748e543d1ff7f52.exe -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
74f032309f78c230c748e543d1ff7f52.exe74f032309f78c230c748e543d1ff7f52.exepid process 384 74f032309f78c230c748e543d1ff7f52.exe 5080 74f032309f78c230c748e543d1ff7f52.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
74f032309f78c230c748e543d1ff7f52.exedescription pid process target process PID 384 wrote to memory of 5080 384 74f032309f78c230c748e543d1ff7f52.exe 74f032309f78c230c748e543d1ff7f52.exe PID 384 wrote to memory of 5080 384 74f032309f78c230c748e543d1ff7f52.exe 74f032309f78c230c748e543d1ff7f52.exe PID 384 wrote to memory of 5080 384 74f032309f78c230c748e543d1ff7f52.exe 74f032309f78c230c748e543d1ff7f52.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f032309f78c230c748e543d1ff7f52.exe"C:\Users\Admin\AppData\Local\Temp\74f032309f78c230c748e543d1ff7f52.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\74f032309f78c230c748e543d1ff7f52.exeC:\Users\Admin\AppData\Local\Temp\74f032309f78c230c748e543d1ff7f52.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:5080
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\74f032309f78c230c748e543d1ff7f52.exeFilesize
784KB
MD53c86e153dfa59a2fbce771aeda3814f6
SHA172aa7b576e5cb9ca8ce8e373c650205c4a86c344
SHA2560e7a6619dfc8ea561213c5b992f90d5f65d83cef867970193ef9f4443712cab8
SHA512addff6027b60d74bd8eb95b8d33da069e7e242ec5f17de795e67584ff0cf7c6c8b18e22aac7fc0c23a480be8c86e83703707fe08ccdba0a95f8378da5619b2bb
-
memory/384-0-0x0000000000400000-0x0000000000712000-memory.dmpFilesize
3.1MB
-
memory/384-1-0x0000000001720000-0x00000000017E4000-memory.dmpFilesize
784KB
-
memory/384-2-0x0000000000400000-0x0000000000593000-memory.dmpFilesize
1.6MB
-
memory/384-12-0x0000000000400000-0x0000000000593000-memory.dmpFilesize
1.6MB
-
memory/5080-13-0x0000000000400000-0x0000000000712000-memory.dmpFilesize
3.1MB
-
memory/5080-14-0x0000000001720000-0x00000000017E4000-memory.dmpFilesize
784KB
-
memory/5080-15-0x0000000000400000-0x0000000000593000-memory.dmpFilesize
1.6MB
-
memory/5080-20-0x0000000000400000-0x0000000000587000-memory.dmpFilesize
1.5MB
-
memory/5080-22-0x0000000005510000-0x00000000056A3000-memory.dmpFilesize
1.6MB
-
memory/5080-30-0x0000000000400000-0x0000000000587000-memory.dmpFilesize
1.5MB