Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
27-01-2024 23:07
General
-
Target
file.exe
-
Size
2.5MB
-
MD5
5dec9f02f7067194f9928e37ed05c8f6
-
SHA1
06f13ca068514d08f0595ded4ef140078888235a
-
SHA256
dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806
-
SHA512
98f980ab103c54c4b1b344b738bcaccd10a35923749a730dd3386355897156d382f01715d07a056ff7451e876898a76268328f92d1e8203b254bb7a082f18e7c
-
SSDEEP
49152:A0jhMlqDbsynliN2InCFvy0l2aMEBLWw/3Ry0rP3Fga/EO7xhbAIXdTBpox:QyliNjnCFvxMEWw/hy0bFga/d7vbASB2
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 13 IoCs
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ACULXOBT"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ACULXOBT"2⤵
- Launches sc.exe
-
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeC:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5cd6628749038b0dfc2ede71a98df1f5a
SHA1da56627fbaddfa249ca9d966459795eeef12f86e
SHA256f2724e0e6cd0d17ddc98fd018f06679a136e87be74d7f28f85986c2028d0a2a0
SHA512b43709b0cb2397639acfdae5ff4971fa45e265f8b847b1c3d2aa7863fd4887e429e5db8a454868bdce7212ab58b952d9d71143759f22ddbc6b7c588b1478b339
-
Filesize
2.0MB
MD54578db7feea613eb8794864a5bbfc0a7
SHA1219e2f2dd5af10804f727b1a6bfecfe379a9e5d0
SHA2561f593517705e5c325dccffcd1eb10db3e234e7edbbe5b68f2e8e445efadffb1a
SHA5123387de844c88c9a969f39dfc834f88929740c2b028945d9a607f67315d4cf9f4455463e4715769b74eff7f120e8c3b33b6a01a36c31511c1207af1a4c41b0091
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB