Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe
Resource
win10v2004-20240426-en
General
-
Target
SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe
-
Size
242KB
-
MD5
a3f767e76c8c6baa9a154d576c7ba49d
-
SHA1
c9a2479bd372fd3ae569b67fc132eac6d5ad9ef0
-
SHA256
eb9a9a49e21219cdc673eb0b3266c2f4c2a759df7c17f4c19ede70e1d5b01dc5
-
SHA512
6e567b6dab41a56eb777a06644e1f6ba0d80131ebcd03443e3b526ef5f7dfaaa3f41ee175a26e976d1b6deef4967d677ec71f87cc63a26559e39e1a6c46042ab
-
SSDEEP
6144:94OlpLX5KTcVgpod/a3gctM7lresEobLr49+I:igX5Pg2dC3ft+wsEobLr49j
Malware Config
Signatures
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exedescription pid process target process PID 244 set thread context of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 set thread context of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 set thread context of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4740 1876 WerFault.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe 4716 4160 WerFault.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe 32 1596 WerFault.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exedescription pid process Token: SeDebugPrivilege 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exedescription pid process target process PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1596 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 1876 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe PID 244 wrote to memory of 4160 244 SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 123⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CoinminerX-gen.22200.11178.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1596 -ip 15961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1876 -ip 18761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4160 -ip 41601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/244-0-0x000000007466E000-0x000000007466F000-memory.dmpFilesize
4KB
-
memory/244-1-0x0000000000A00000-0x0000000000A46000-memory.dmpFilesize
280KB
-
memory/244-2-0x0000000002CC0000-0x0000000002CC6000-memory.dmpFilesize
24KB
-
memory/244-3-0x0000000074660000-0x0000000074E10000-memory.dmpFilesize
7.7MB
-
memory/244-4-0x00000000053C0000-0x0000000005400000-memory.dmpFilesize
256KB
-
memory/244-5-0x00000000056E0000-0x000000000577C000-memory.dmpFilesize
624KB
-
memory/244-6-0x0000000005D30000-0x00000000062D4000-memory.dmpFilesize
5.6MB
-
memory/244-7-0x0000000005820000-0x00000000058B2000-memory.dmpFilesize
584KB
-
memory/244-8-0x0000000005410000-0x0000000005416000-memory.dmpFilesize
24KB
-
memory/244-11-0x0000000074660000-0x0000000074E10000-memory.dmpFilesize
7.7MB