Resubmissions
06/07/2024, 19:03 UTC
240706-xqksaazhrm 1021/06/2024, 07:08 UTC
240621-hyl8razgpc 1016/06/2024, 18:48 UTC
240616-xf5ppswgmq 1016/06/2024, 18:34 UTC
240616-w759wasbqf 1016/06/2024, 18:21 UTC
240616-wzje5swajj 1016/06/2024, 18:08 UTC
240616-wqxams1ekf 1016/06/2024, 17:54 UTC
240616-whbzqsvcrn 1016/06/2024, 17:41 UTC
240616-v9q3aszhkf 1016/06/2024, 17:28 UTC
240616-v1237szgpc 10Analysis
-
max time kernel
1791s -
max time network
1804s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15/05/2024, 20:56 UTC
General
-
Target
main - Copy (8) - Copy.exe
-
Size
6.9MB
-
MD5
22c978ffaefef3389bf29068b9621661
-
SHA1
5671972c1d70826fb85dced4c83c700dd282ea21
-
SHA256
e6ee8e9b38e10a92a89e61b8655ca4fedcc381fd93cb36f43fe323132923dfcf
-
SHA512
8a280cb782f0afab171d2e7955b75362e98cefd449d382004ef2568c2c230cd633a754b1dd5f0dc5e17407819e4dceb5b0cbb2647e279a6ec674b8d9484be26a
-
SSDEEP
98304:7b5Ak7khMiyw0VREqfnle5EEPbxVhCQHSIMf:5LUMiywZqshDxaQHh
Score
10/10
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exexmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b142⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3648,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:81⤵
Network
-
DNS71.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse -
DNS249.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request249.197.17.2.in-addr.arpaIN PTRResponse249.197.17.2.in-addr.arpaIN PTRa2-17-197-249deploystaticakamaitechnologiescom
-
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNSgithub.comRemote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
DNS215.156.26.20.in-addr.arpaRemote address:8.8.8.8:53Request215.156.26.20.in-addr.arpaIN PTRResponse
-
DNSobjects.githubusercontent.comRemote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.108.133objects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.111.133
-
DNS76.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:23.62.61.194:443RequestGET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Wed, 15 May 2024 21:21:58 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.be3d3e17.1715808118.321081
-
DNS133.108.199.185.in-addr.arpaRemote address:8.8.8.8:53Request133.108.199.185.in-addr.arpaIN PTRResponse133.108.199.185.in-addr.arpaIN PTRcdn-185-199-108-133githubcom
-
DNS194.61.62.23.in-addr.arpaRemote address:8.8.8.8:53Request194.61.62.23.in-addr.arpaIN PTRResponse194.61.62.23.in-addr.arpaIN PTRa23-62-61-194deploystaticakamaitechnologiescom
-
DNS232.168.11.51.in-addr.arpaRemote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
DNSpool.hashvault.proRemote address:8.8.8.8:53Requestpool.hashvault.proIN AResponsepool.hashvault.proIN A45.76.89.70pool.hashvault.proIN A95.179.241.203
-
DNS203.241.179.95.in-addr.arpaRemote address:8.8.8.8:53Request203.241.179.95.in-addr.arpaIN PTRResponse203.241.179.95.in-addr.arpaIN PTR95179241203vultrusercontentcom
-
DNS203.241.179.95.in-addr.arpaRemote address:8.8.8.8:53Request203.241.179.95.in-addr.arpaIN PTR
-
DNS203.241.179.95.in-addr.arpaRemote address:8.8.8.8:53Request203.241.179.95.in-addr.arpaIN PTR
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTR
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS21.121.18.2.in-addr.arpaRemote address:8.8.8.8:53Request21.121.18.2.in-addr.arpaIN PTRResponse21.121.18.2.in-addr.arpaIN PTRa2-18-121-21deploystaticakamaitechnologiescom
-
DNS21.121.18.2.in-addr.arpaRemote address:8.8.8.8:53Request21.121.18.2.in-addr.arpaIN PTR
-
DNS43.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
DNS240.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTRResponse240.197.17.2.in-addr.arpaIN PTRa2-17-197-240deploystaticakamaitechnologiescom
-
DNS240.197.17.2.in-addr.arpaRemote address:8.8.8.8:53Request240.197.17.2.in-addr.arpaIN PTR
-
DNS195.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request195.201.50.20.in-addr.arpaIN PTRResponse
-
DNS195.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request195.201.50.20.in-addr.arpaIN PTR
-
DNS195.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request195.201.50.20.in-addr.arpaIN PTR
-
DNS195.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request195.201.50.20.in-addr.arpaIN PTR
-
DNS195.201.50.20.in-addr.arpaRemote address:8.8.8.8:53Request195.201.50.20.in-addr.arpaIN PTR
-
20.26.156.215:443github.comtls -
185.199.108.133:443objects.githubusercontent.comtls
-
23.62.61.194:443https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200 -
95.179.241.203:80pool.hashvault.protls -
52.142.223.178:80
-
8.8.8.8:5371.159.190.20.in-addr.arpadns
DNS Request
71.159.190.20.in-addr.arpa
-
8.8.8.8:53249.197.17.2.in-addr.arpadns
DNS Request
249.197.17.2.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:53github.comdns
DNS Request
github.com
DNS Response
20.26.156.215
-
8.8.8.8:53215.156.26.20.in-addr.arpadns
DNS Request
215.156.26.20.in-addr.arpa
-
8.8.8.8:53objects.githubusercontent.comdns
DNS Request
objects.githubusercontent.com
DNS Response
185.199.108.133185.199.109.133185.199.110.133185.199.111.133
-
8.8.8.8:5376.32.126.40.in-addr.arpadns
DNS Request
76.32.126.40.in-addr.arpa
-
8.8.8.8:53133.108.199.185.in-addr.arpadns
DNS Request
133.108.199.185.in-addr.arpa
-
8.8.8.8:53194.61.62.23.in-addr.arpadns
DNS Request
194.61.62.23.in-addr.arpa
-
8.8.8.8:53232.168.11.51.in-addr.arpadns
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:53pool.hashvault.prodns
DNS Request
pool.hashvault.pro
DNS Response
45.76.89.7095.179.241.203
-
8.8.8.8:53203.241.179.95.in-addr.arpadns
DNS Request
203.241.179.95.in-addr.arpa
DNS Request
203.241.179.95.in-addr.arpa
DNS Request
203.241.179.95.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:5321.121.18.2.in-addr.arpadns
DNS Request
21.121.18.2.in-addr.arpa
DNS Request
21.121.18.2.in-addr.arpa
-
8.8.8.8:5343.229.111.52.in-addr.arpadns
DNS Request
43.229.111.52.in-addr.arpa
-
8.8.8.8:53240.197.17.2.in-addr.arpadns
DNS Request
240.197.17.2.in-addr.arpa
DNS Request
240.197.17.2.in-addr.arpa
-
8.8.8.8:53195.201.50.20.in-addr.arpadns
DNS Request
195.201.50.20.in-addr.arpa
DNS Request
195.201.50.20.in-addr.arpa
DNS Request
195.201.50.20.in-addr.arpa
DNS Request
195.201.50.20.in-addr.arpa
DNS Request
195.201.50.20.in-addr.arpa
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD5e2fe87cc2c7dab8ca6516620dccd1381
SHA1f714ec0448325435103519452610cf7aadf8bbba
SHA256d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA5128455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB
-
Filesize
11.0MB