Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 04:33
Behavioral task
behavioral1
Sample
8d8e29533121358fa75361ad51183820.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
General
- Target 8d8e29533121358fa75361ad51183820.exe
- Size 1.6MB
- Sample240518-e6nvrscb29
- SHA256 873a71a6dca392782035ae866683f15647f789be003e625e0e5d5d4e06fa6d08
- MD5 8d8e29533121358fa75361ad51183820
- SHA1 4afc0e9b37870263684b47f7d5ed2c74eaf75e9e
- SHA512 1a91db5147c070e7d39234ac4c2e54450a15ab9ee269a7ba73cda099b9c0a34791c15cd7eb45ad6780135c58cb02194313c4881932b6e46ec221c6407eca60f4
- SSDEEP 24576:gavo/YFhnivTP0lhLuFEFotb0XUGH0gUu2ZfdOPAklQuYi/XxgI:gEo/Ul0atGYUGHv92ZfY5l3j/aI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- XMRig Miner payload 15 IoCs
resource yara_rule behavioral2/memory/3524-3-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-6-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-7-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-8-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-10-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-12-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-13-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-14-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-15-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-16-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-17-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-18-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-19-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-20-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig behavioral2/memory/3524-21-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/3524-0-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-3-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-6-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-7-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-8-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-10-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-12-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-13-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-14-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-15-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-16-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-17-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-18-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-19-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-20-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx behavioral2/memory/3524-21-0x00007FF6C47B0000-0x00007FF6C4EF1000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe 3524 8d8e29533121358fa75361ad51183820.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3524 8d8e29533121358fa75361ad51183820.exe Token: SeLockMemoryPrivilege 3524 8d8e29533121358fa75361ad51183820.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3524 8d8e29533121358fa75361ad51183820.exe