Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 20:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
901a220e5df678447748e6cbeeb0677e.exe
Resource
win7-20231129-en
3 signatures
150 seconds
General
-
Target
901a220e5df678447748e6cbeeb0677e.exe
-
Size
3.0MB
-
MD5
901a220e5df678447748e6cbeeb0677e
-
SHA1
dd4ba95089f855d22bcdce7af6d06e3f3d148f20
-
SHA256
d8271f3e0d6038eb6de0a34a0a2f7adabe7a288059bfa639c3c4c6955b59c499
-
SHA512
e51e9fec3294638e11d7856eb675d768e1529392efdce5ae09d76228703d55bf0d23ba9ee55654399c0313fa03c23682c8481bfd65f2e6a2faa548f92775153e
-
SSDEEP
49152:I1y0tZWsuoAQrkz+cWlPi7+dNJDZvQzAtrGkwAKzutQy:JWMsDAukz+cW1G+rJ1QctrGkdKzQQy
Malware Config
Signatures
-
XMRig Miner payload 21 IoCs
resource yara_rule behavioral2/memory/1140-3-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-4-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-5-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-6-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-7-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-8-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-9-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-10-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-11-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-12-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-13-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-14-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-15-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-16-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-17-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-18-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-19-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-20-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-21-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-22-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig behavioral2/memory/1140-23-0x00007FF67D720000-0x00007FF67E0B5000-memory.dmp xmrig -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1140 901a220e5df678447748e6cbeeb0677e.exe Token: SeLockMemoryPrivilege 1140 901a220e5df678447748e6cbeeb0677e.exe