Analysis
-
max time kernel
190s -
max time network
300s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
-
submitted
07-02-2024 04:55
General
-
Target
dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806.exe
-
Size
2.5MB
-
MD5
5dec9f02f7067194f9928e37ed05c8f6
-
SHA1
06f13ca068514d08f0595ded4ef140078888235a
-
SHA256
dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806
-
SHA512
98f980ab103c54c4b1b344b738bcaccd10a35923749a730dd3386355897156d382f01715d07a056ff7451e876898a76268328f92d1e8203b254bb7a082f18e7c
-
SSDEEP
49152:A0jhMlqDbsynliN2InCFvy0l2aMEBLWw/3Ry0rP3Fga/EO7xhbAIXdTBpox:QyliNjnCFvxMEWw/hy0bFga/d7vbASB2
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 13 IoCs
-
Creates new service(s) 1 TTPs
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806.exe"C:\Users\Admin\AppData\Local\Temp\dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "ACULXOBT"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "ACULXOBT"2⤵
- Launches sc.exe
-
-
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exeC:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
760KB
MD5cc3d5d3620b01ff2d3bc8a33edc12682
SHA153b409d014fd52b85c179b7cd24016684b7c5025
SHA2561cb3b02e6df31e3454ab852af565a08a2b7484086eebd3f0b85ea7f2f8ecf277
SHA512324478248d653103e1170118bf504c7bd78525d5977e64052eaa2429ef4042820c17e5644dd495d51109b32d8c7cb8a31c26350fd42bba72dc938a8d261dde90
-
Filesize
924KB
MD593452759bd84778c63e16d0ab0d98818
SHA1d642a2cc6e7f8114d193fb2000fe6fb32a958182
SHA2566d9a2ea97280b64c6db65243346ef83c6b7b62cdd68b5d348dd22773aa52b2a5
SHA5123d51444ec62ac22fbf63ed07325aaebbf73e6072154cbe3530a0f03c33bf87d4a639785d76e3ddfe678686e9b7aee9fc04acb9b5899b9f774f076913e7742840
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
128KB