General
-
Target
f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c.exe
-
Size
13.2MB
-
Sample
240523-cn43xsab3y
-
MD5
9e77a1c36b7ee264c38b958963769c08
-
SHA1
eb7ad58040a6dbf826a37d52c26f7ce8ef963342
-
SHA256
f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c
-
SHA512
cb4867e6d1eac352c59285e5b51128a54347e0780826b9c8221e516d650aa815d518591c8d4594a09b0ef331da29a9b49c0cab47987d035abda32f599be06cff
-
SSDEEP
196608:XiwmU0yb8PHvOzg5dpsYjAu3toeQXs5S+9HIG3/htx4FMIZETSvjPePdrQJ/B2nw:ywuky7h/QXs4+9H7/DxQETSvvJsWp1
Behavioral task
behavioral1
Sample
f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c.exe
Resource
win7-20240508-en
Malware Config
Targets
-
-
Target
f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c.exe
-
Size
13.2MB
-
MD5
9e77a1c36b7ee264c38b958963769c08
-
SHA1
eb7ad58040a6dbf826a37d52c26f7ce8ef963342
-
SHA256
f1836d3e4c6916cdc1f873b430d0a2784885e587683f6917fd51c04eba18933c
-
SHA512
cb4867e6d1eac352c59285e5b51128a54347e0780826b9c8221e516d650aa815d518591c8d4594a09b0ef331da29a9b49c0cab47987d035abda32f599be06cff
-
SSDEEP
196608:XiwmU0yb8PHvOzg5dpsYjAu3toeQXs5S+9HIG3/htx4FMIZETSvjPePdrQJ/B2nw:ywuky7h/QXs4+9H7/DxQETSvvJsWp1
-
Detects executables referencing many IR and analysis tools
-
UPX dump on OEP (original entry point)
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-