Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/01/2024, 13:50
General
-
Target
ccb1f8eda38035cc9f93f46786dbe146.exe
-
Size
3.5MB
-
MD5
ccb1f8eda38035cc9f93f46786dbe146
-
SHA1
6eb2e28bb5001e3c25262495e2f2fb0607de99dd
-
SHA256
03c4964299ebbe765ef18d901be45b17e69e6b0d3a71f7eb43a28be4b0bb3d02
-
SHA512
70df2f86085343ce9390f3af01c468f9d34a273116227a2002c5e8b6c4b331ca6b8592fa599f245b89dc2bf510dda4a33ea7780d3ef0dba40c957f3f51419f3b
-
SSDEEP
49152:lOw5cT7kCAPfy6JliMmBS0NExxVWS62fRHMaUSKb+e24mwBTtXjU5QOX:koEiVx0wJsaGbjxh
Malware Config
Signatures
-
XMRig Miner payload 15 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccb1f8eda38035cc9f93f46786dbe146.exe"C:\Users\Admin\AppData\Local\Temp\ccb1f8eda38035cc9f93f46786dbe146.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\cleanhelper.dll T34 /k notfun123 /auto 22⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\Volt\xmrig.exeC:\Users\Admin\AppData\Roaming\Volt\xmrig.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
597KB
MD53a545eaeb3c646d80716c325298b4db5
SHA13eefc6c2268ea0298c39dea9fbd71987b31989d5
SHA256fd793216e10034cf0e2b57956d5fffa5d816551712d53bab79d8cbbd11d7df1d
SHA512b5650776302d30d0d29f5369d21a62d8a17409926be0864b5578d80393133b663a4527316babbe5388c78b32330afb5f3e1e484be92b43b113ff9c2737efc2ef
-
Filesize
3KB
MD5d9cf79f1697c4eab98b01f1396a41058
SHA1e973de6064bc4acc870edf20736299b4af5e94ad
SHA256162547817f101090b503bda122a81286a487936aab966adb53105962313b6164
SHA512b9cfa1c4a52af313a5a092152a5fefcf5ef5f8141944589e611ef90743b103374a9f84ce1aba04c5b3bf0a3e9798d2c4a11d53997cc5622b72ccc1a5e3983bad
-
Filesize
3.6MB
MD5d14d525eff62f77fb388273e7a67874a
SHA107444ffef7ade5b3a39332ef74277754c1c6b41e
SHA256d1b97a919b793ab2733e25f3d5b039c0dd5cbc1d8fc350eb14a0a1ea8c23dd79
SHA5127cd736f4636526054cb3d4d9a300c73fd367c778a95cdb44f6411ffb38864e5a0b93bb0f8237573a7e94167aa8adf40a35264d22ad47af58a59c50fec22e1a50
-
Filesize
192B
MD5229411e44b5a0491625e3dfc56592232
SHA16c3c5af029c4b1376cd74e4b547a9fcade97a7f3
SHA256e5cb2d7bc2d9dba21f43a684b2c31113b6b4e9ed22bc63467fdff840f0f894f3
SHA512c0e4dee29091b1dea232cdbd3f3e1c7878df3163d5a7ca238a6f9b9dd5ec00d5ccc816b4fb8149282e191ec047b6c6c8f4c461cb272955bf59de9e43b0e58eec
-
Filesize
588KB
-
Filesize
588KB
-
Filesize
588KB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
8.1MB
-
Filesize
592KB
-
Filesize
592KB
-
Filesize
8KB
-
Filesize
16KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB