Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 12:27
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe
-
Size
2.8MB
-
MD5
7f1e688e77760ad29c560404a2fb9d2f
-
SHA1
7c06e05c8e13d01df26653cbe12695af139c5854
-
SHA256
086bcb65380fa0e4d23c07fbff58863949f8158b87d07cd6eac6485d99b3bf0d
-
SHA512
e841524c36ec9f550bbd299fbd33bbf15587dde922c747ae719bea03c387e62bbb9a73fdee0188dfb1586cca5b9dc81745144e633ed3dcb661434ab1c87e393e
-
SSDEEP
49152:lAfXmQ/GT5+pDEuOwHLHE83/G9+SbSyCfHtl8/ioefjKxAd2jVAeIXT:2+4GT0OSL04Dl8/gcAsJAeIj
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/4752-3-0x0000000005150000-0x0000000005384000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-6-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-7-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-9-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-11-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-13-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-15-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-17-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-19-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-21-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-23-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-25-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-27-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-29-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-31-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-33-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-35-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-37-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-39-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-41-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-43-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-45-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-47-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-49-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-51-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-53-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-55-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-57-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-59-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-61-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-63-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-65-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-67-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 behavioral2/memory/4752-69-0x0000000005150000-0x000000000537E000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exedescription pid process target process PID 4752 set thread context of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4624 1304 WerFault.exe MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exedescription pid process Token: SeDebugPrivilege 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe Token: SeDebugPrivilege 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exedescription pid process target process PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe PID 4752 wrote to memory of 1304 4752 SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.23583.11262.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:1304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 1923⤵
- Program crash
PID:4624
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:1648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1304 -ip 13041⤵PID:3644