Analysis
-
max time kernel
117s -
max time network
289s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
07-02-2024 04:55
General
-
Target
dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806.exe
-
Size
2.5MB
-
MD5
5dec9f02f7067194f9928e37ed05c8f6
-
SHA1
06f13ca068514d08f0595ded4ef140078888235a
-
SHA256
dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806
-
SHA512
98f980ab103c54c4b1b344b738bcaccd10a35923749a730dd3386355897156d382f01715d07a056ff7451e876898a76268328f92d1e8203b254bb7a082f18e7c
-
SSDEEP
49152:A0jhMlqDbsynliN2InCFvy0l2aMEBLWw/3Ry0rP3Fga/EO7xhbAIXdTBpox:QyliNjnCFvxMEWw/hy0bFga/d7vbASB2
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 6 IoCs
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806.exe"C:\Users\Admin\AppData\Local\Temp\dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ACULXOBT"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ACULXOBT"2⤵
- Launches sc.exe
-
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeC:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
346KB
MD5a4c22dbf998fdf87214e9187575a1511
SHA1191d695db4fec63cd7a9be4c1c581d8a2798d15d
SHA256826a4b370eb46e85dda90a67091a88666b4b9c6487f8a10e245664aedf855f30
SHA512b422e081e975da5129b97ff5d74503e46a3a118c234fa2b172ed4b06fa1fa278b40fc63d69f4aa84dedd1f9d2f47b4abc1c944b41b487d2d3fe50de1d090592b
-
Filesize
796KB
MD51e9de68d7863a0138ad5944ab55bf792
SHA18301e3e4389ce818d506fd5063b46f2f80a573b8
SHA256506c01d5f9a152376ae8985a2fd540e138b1f7b72dcf9f006b845af093b5207c
SHA51228c3c170851ac3858ff0e8f1e343bc6083b9edf701e7fc44722b71bd926c7a2b8d3672fc146507c48a3577fab37d0acae31336cfcac6ffadbe98639f14850110
-
Filesize
128KB
MD5d612d9d6dd2a8c6ed9aee4944daafef8
SHA109b523241299dad0b76f2af97d189055d16fe5b1
SHA256d1561519293a2eb62454d86eb29f511744f32a0ec67a7c2ef2858590a315a628
SHA512e747505660fd2c5650f270c6c641e6fcb40e518d8b6c72d5652b39dc63bbba5f8b0922b079f62243f1d24d2395fc24c5b3edf861779c0e4ed0e9239b7bb92512
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB