Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04-02-2024 02:00
General
-
Target
tmp.exe
-
Size
2.5MB
-
MD5
f44f200e7d7f8ae6035b382a2a4240dd
-
SHA1
8f11e6d44050813db4aa6ba0971ab873cc3ad797
-
SHA256
a8ae29395e8234f4d2a35a88ff8d34b353c716d81d0d7e05eacc5d4e2a2aacc8
-
SHA512
193781602d1768e170dd9ed149fd07fe72f84789a7d25fe59ad62555f381e7470b4d30866609cf4a387834ed7fda7a2a552d8654117c5dea5cf3288b58c68a39
-
SSDEEP
49152:3hU0Vy41dosEvIMf9FhcBYFUjeCnfDCvNb2aeP4mN:RU0zPoTvIYnh8vIlq
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 13 IoCs
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "XGRXZRAP"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "XGRXZRAP" binpath= "C:\ProgramData\wdkmvkocxuib\smazgcisoglo.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "XGRXZRAP"2⤵
- Launches sc.exe
-
-
C:\ProgramData\wdkmvkocxuib\smazgcisoglo.exeC:\ProgramData\wdkmvkocxuib\smazgcisoglo.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5145c5edb288706e4b629545ab3c80e8f
SHA1ee2acb3d83c0da72ae6963bdeb899f3c435d2537
SHA256a0bce6ec2dfa6cf8bb82a84bb2a81e8b36c8cbba698eb7b6c275ea91b2ddd0d3
SHA51258815349f4ee6d7e5024edf5b6265f24aca7ece44ec85e0d9dc4f37e90072ef9d3c9d9870e89688a4a686f84b9ecee85436d3b30c991d833bead84492717c847
-
Filesize
68KB
MD5809cc1682de16e24f589d9b28e41636d
SHA1b120dde1ceb228d8dd1894818fee35c4e377847c
SHA256d7d96b7987ea84e038edc3eca7c0eeb89624e29831206192ba63e24dc4253ca8
SHA512721a4bbe2007d6c2183245bf6b3e32120d402948284e31017d0894443d735372bea6059990ba8ecf23722f62bad90f030bf1c45745a102d3b61cb5c440ec8972
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB