Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
03/02/2024, 19:39
General
-
Target
file.exe
-
Size
2.5MB
-
MD5
a23e64ae9179c3bf6a1850591d541b29
-
SHA1
a2cac962fb9004a523a17251243b49d52046fc1d
-
SHA256
4bd8648e1321262d988f1379ffc4d752dfffd5b0de4b16d2ece6fd5965bca31e
-
SHA512
4c0706d8519fc5fff3fa0a32a18b2d027079dd323772db28c9753ae05e1af16072c66c6fadcaf9e13c6703f480174294d353ec0d3e2297145f052c70b43bd403
-
SSDEEP
49152:LBVf/W4kQiybZloH6WUgJAB+FTB0TH1bEwfUcLfBlJzHpr1StId:NVf/7bbZloHS/B+FTB/wfPnJz/S
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 13 IoCs
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "AFCCSAOG"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "AFCCSAOG" binpath= "C:\ProgramData\wpiqbfamrwgt\juqermtyedmi.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "AFCCSAOG"2⤵
- Launches sc.exe
-
-
C:\ProgramData\wpiqbfamrwgt\juqermtyedmi.exeC:\ProgramData\wpiqbfamrwgt\juqermtyedmi.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5820a350eea4f3678d14cb6e80700a457
SHA1f845117514e3628b5e87ce7479014387b948c2e7
SHA256a8ed8024e59910cce07f0be7d07930b6603b37bf400b88961a42431a6bcec20e
SHA5122008dc383637b486d98e6ead5de9f1d72e7743b13453cf1fa03e63b5128e6210bfb0b986c77b1a32949bfca897f56abed8fe8f48e3773a742cb5219707faaf8d
-
Filesize
1.1MB
MD5c1c9fe11d067c74777887d6633a55a26
SHA1d1762011a1d210a7cabfc0c588f2c5ee865af73d
SHA25699e345fed42e9f6c9181a6cfda11782cef43c5a40d6ab5f58aceea95c532fa7c
SHA51204eae0df37890bab95a38275906c48d4b7c6b884b6f6e1f96f956335241e2429abd5622b71baf2ff41adf82b6ca591cc64fba8f774b84d0370ced91393032bb8
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB