Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07/03/2024, 17:59
General
-
Target
b95295d8a6fa1071340cab5054860161.exe
-
Size
4.7MB
-
MD5
b95295d8a6fa1071340cab5054860161
-
SHA1
377714f8ed84e6ed7f6e66f788a3e0498588c8b1
-
SHA256
eb418cf6610dcf5ef62b1349051591d995e51c601f91ddf9fde08013656d6eb5
-
SHA512
9075a363ca0d4325c21f16d92a242d19e143c472bcb333a6e51835e4f59ce41ed02fa4389ce366e0420e4ced2ee27dfb5652105db16c809636ef437ad74313d1
-
SSDEEP
98304:yvyu7TRge+oa0uaDpFRBkLDBo/MuBGnY8IEr3kXx1:ylRge+4uaLYIXMH0Xx1
Score
10/10
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
XMRig Miner payload 5 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b95295d8a6fa1071340cab5054860161.exe"C:\Users\Admin\AppData\Local\Temp\b95295d8a6fa1071340cab5054860161.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.2MB
-
Filesize
1.7MB
-
Filesize
18.2MB
-
Filesize
18.2MB
-
Filesize
18.2MB
-
Filesize
18.2MB
-
Filesize
18.2MB
-
Filesize
128KB
-
Filesize
18.2MB
-
Filesize
1.7MB