Analysis Overview
SHA256
2712cfc84e57a8c2c3637bc69d65c1741fcb7a600c78709bbe3d47c5f76a4293
Threat Level: Known bad
The file packer.zip was found to be: Known bad.
Malicious Activity Summary
xmrig
XMRig Miner payload
Executes dropped EXE
Unsigned PE
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-06-13 09:37
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral20
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1794s
Max time network
1805s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3656 wrote to memory of 2996 | N/A | C:\Users\Admin\AppData\Local\Temp\main.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 3656 wrote to memory of 2996 | N/A | C:\Users\Admin\AppData\Local\Temp\main.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.110.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| US | 8.8.8.8:53 | 133.110.199.185.in-addr.arpa | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.253.116.51.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/2996-14-0x000002338E7A0000-0x000002338E7C0000-memory.dmp
memory/2996-15-0x0000023422320000-0x0000023422340000-memory.dmp
memory/2996-16-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-18-0x0000023422990000-0x00000234229B0000-memory.dmp
memory/2996-17-0x0000023422970000-0x0000023422990000-memory.dmp
memory/2996-19-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-20-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-23-0x0000023422990000-0x00000234229B0000-memory.dmp
memory/2996-22-0x0000023422970000-0x0000023422990000-memory.dmp
memory/2996-21-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-24-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-25-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-26-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-27-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-28-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-29-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-30-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-31-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-32-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-33-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-34-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-35-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-36-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-37-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-38-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-39-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-40-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-41-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-42-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-43-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-44-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-45-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-46-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-47-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-48-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-49-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-50-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-51-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-52-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-53-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-54-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-55-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-56-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-57-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-58-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-59-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-60-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-61-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-62-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-63-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-64-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-65-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-66-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-67-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-68-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-69-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-70-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-71-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-72-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-73-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-74-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-75-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-76-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-77-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-78-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-79-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-80-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-81-0x00007FF746A40000-0x00007FF747543000-memory.dmp
memory/2996-82-0x00007FF746A40000-0x00007FF747543000-memory.dmp
Analysis: behavioral5
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240611-en
Max time kernel
1793s
Max time network
1797s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2840 wrote to memory of 3756 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 2840 wrote to memory of 3756 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/3756-14-0x0000025083090000-0x00000250830B0000-memory.dmp
memory/3756-15-0x0000025084AD0000-0x0000025084AF0000-memory.dmp
memory/3756-16-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-18-0x0000025084AF0000-0x0000025084B10000-memory.dmp
memory/3756-17-0x0000025084B10000-0x0000025084B30000-memory.dmp
memory/3756-19-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-20-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-23-0x0000025084AF0000-0x0000025084B10000-memory.dmp
memory/3756-22-0x0000025084B10000-0x0000025084B30000-memory.dmp
memory/3756-21-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-24-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-25-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-26-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-27-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-28-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-29-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-30-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-31-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-32-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-33-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-34-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-35-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-36-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-37-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-38-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-39-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-40-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-41-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-42-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-43-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-44-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-45-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-46-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-47-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-48-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-49-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-50-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-51-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-52-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-53-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-54-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-55-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-56-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-57-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-58-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-59-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-60-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-61-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-62-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-63-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-64-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-65-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-66-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-67-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-68-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-69-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-70-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-71-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-72-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-73-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-74-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-75-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-76-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-77-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-78-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-79-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-80-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-81-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
memory/3756-82-0x00007FF7D7CB0000-0x00007FF7D87B3000-memory.dmp
Analysis: behavioral13
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1795s
Max time network
1796s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4740 wrote to memory of 1352 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 4740 wrote to memory of 1352 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| BE | 2.17.107.120:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 120.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/1352-14-0x000002619C120000-0x000002619C140000-memory.dmp
memory/1352-15-0x000002619D890000-0x000002619D8B0000-memory.dmp
memory/1352-16-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-18-0x0000026230270000-0x0000026230290000-memory.dmp
memory/1352-17-0x0000026230250000-0x0000026230270000-memory.dmp
memory/1352-19-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-20-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-21-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-22-0x0000026230250000-0x0000026230270000-memory.dmp
memory/1352-23-0x0000026230270000-0x0000026230290000-memory.dmp
memory/1352-24-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-25-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-26-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-27-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-28-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-29-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-30-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-31-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-32-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-33-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-34-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-35-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-36-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-37-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-38-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-39-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-40-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-41-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-42-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-43-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-44-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-45-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-46-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-47-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-48-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-49-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-50-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-51-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-52-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-53-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-54-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-55-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-56-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-57-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-58-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-59-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-60-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-61-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-62-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-63-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-64-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-65-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-66-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-67-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-68-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-69-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-70-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-71-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-72-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-73-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-74-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-75-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-76-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-77-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-78-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-79-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-80-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-81-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
memory/1352-82-0x00007FF78A2A0000-0x00007FF78ADA3000-memory.dmp
Analysis: behavioral16
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1794s
Max time network
1800s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3236 wrote to memory of 232 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 3236 wrote to memory of 232 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4088,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4664,i,3549704109630749084,1975543916261970610,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/232-14-0x000001EF86D50000-0x000001EF86D70000-memory.dmp
memory/232-15-0x000001EF86D80000-0x000001EF86DA0000-memory.dmp
memory/232-16-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-17-0x000001EF86DA0000-0x000001EF86DC0000-memory.dmp
memory/232-18-0x000001EF86DC0000-0x000001EF86DE0000-memory.dmp
memory/232-19-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-20-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-23-0x000001EF86DC0000-0x000001EF86DE0000-memory.dmp
memory/232-22-0x000001EF86DA0000-0x000001EF86DC0000-memory.dmp
memory/232-21-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-24-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-25-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-26-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-27-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-28-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-29-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-30-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-31-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-32-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-33-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-34-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-35-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-36-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-37-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-38-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-39-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-40-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-41-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-42-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-43-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-44-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-45-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-46-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-47-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-48-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-49-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-50-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-51-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-52-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-53-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-54-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-55-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-56-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-57-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-58-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-59-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-60-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-61-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-62-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-63-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-64-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-65-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-66-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-67-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-68-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-69-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-70-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-71-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-72-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-73-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-74-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-75-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-76-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-77-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-78-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-79-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-80-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-81-0x00007FF644670000-0x00007FF645173000-memory.dmp
memory/232-82-0x00007FF644670000-0x00007FF645173000-memory.dmp
Analysis: behavioral17
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1795s
Max time network
1794s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1756 wrote to memory of 2224 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 1756 wrote to memory of 2224 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| BE | 2.17.107.203:80 | tcp | |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 211.143.182.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/2224-14-0x00000261095D0000-0x00000261095F0000-memory.dmp
memory/2224-15-0x000002610AED0000-0x000002610AEF0000-memory.dmp
memory/2224-16-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-18-0x000002610AF10000-0x000002610AF30000-memory.dmp
memory/2224-17-0x000002610AEF0000-0x000002610AF10000-memory.dmp
memory/2224-19-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-20-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-23-0x000002610AF10000-0x000002610AF30000-memory.dmp
memory/2224-22-0x000002610AEF0000-0x000002610AF10000-memory.dmp
memory/2224-21-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-24-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-25-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-26-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-27-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-28-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-29-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-30-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-31-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-32-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-33-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-34-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-35-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-36-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-37-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-38-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-39-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-40-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-41-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-42-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-43-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-44-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-45-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-46-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-47-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-48-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-49-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-50-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-51-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-52-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-53-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-54-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-55-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-56-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-57-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-58-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-59-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-60-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-61-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-62-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-63-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-64-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-65-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-66-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-67-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-68-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-69-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-70-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-71-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-72-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-73-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-74-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-75-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-76-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-77-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-78-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-79-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-80-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-81-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
memory/2224-82-0x00007FF65F7A0000-0x00007FF6602A3000-memory.dmp
Analysis: behavioral18
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1793s
Max time network
1794s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2220 wrote to memory of 5012 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 2220 wrote to memory of 5012 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 72.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.111.133:443 | objects.githubusercontent.com | tcp |
| BE | 88.221.83.201:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 133.111.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.16.208.104.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/5012-14-0x0000027ABFA40000-0x0000027ABFA60000-memory.dmp
memory/5012-15-0x0000027ABFB90000-0x0000027ABFBB0000-memory.dmp
memory/5012-16-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-18-0x0000027ABFBD0000-0x0000027ABFBF0000-memory.dmp
memory/5012-17-0x0000027ABFBB0000-0x0000027ABFBD0000-memory.dmp
memory/5012-19-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-20-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-23-0x0000027ABFBD0000-0x0000027ABFBF0000-memory.dmp
memory/5012-22-0x0000027ABFBB0000-0x0000027ABFBD0000-memory.dmp
memory/5012-21-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-24-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-25-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-26-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-27-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-28-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-29-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-30-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-31-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-32-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-33-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-34-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-35-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-36-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-37-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-38-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-39-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-40-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-41-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-42-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-43-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-44-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-45-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-46-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-47-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-48-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-49-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-50-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-51-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-52-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-53-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-54-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-55-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-56-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-57-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-58-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-59-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-60-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-61-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-62-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-63-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-64-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-65-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-66-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-67-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-68-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-69-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-70-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-71-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-72-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-73-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-74-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-75-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-76-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-77-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-78-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-79-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-80-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-81-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
memory/5012-82-0x00007FF6C88F0000-0x00007FF6C93F3000-memory.dmp
Analysis: behavioral19
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1792s
Max time network
1804s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2976 wrote to memory of 4944 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 2976 wrote to memory of 4944 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 19.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| BE | 88.221.83.209:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.15.31.184.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.162.46.104.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/4944-14-0x00000189657B0000-0x00000189657D0000-memory.dmp
memory/4944-15-0x0000018966F20000-0x0000018966F40000-memory.dmp
memory/4944-16-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-17-0x0000018966F60000-0x0000018966F80000-memory.dmp
memory/4944-18-0x0000018966F40000-0x0000018966F60000-memory.dmp
memory/4944-19-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-20-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-23-0x0000018966F40000-0x0000018966F60000-memory.dmp
memory/4944-22-0x0000018966F60000-0x0000018966F80000-memory.dmp
memory/4944-21-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-24-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-25-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-26-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-27-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-28-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-29-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-30-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-31-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-32-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-33-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-34-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-35-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-36-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-37-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-38-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-39-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-40-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-41-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-42-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-43-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-44-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-45-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-46-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-47-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-48-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-49-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-50-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-51-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-52-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-53-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-54-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-55-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-56-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-57-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-58-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-59-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-60-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-61-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-62-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-63-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-64-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-65-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-66-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-67-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-68-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-69-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-70-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-71-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-72-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-73-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-74-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-75-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-76-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-77-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-78-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-79-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-80-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-81-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
memory/4944-82-0x00007FF7BD560000-0x00007FF7BE063000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1657s
Max time network
1669s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
Files
Analysis: behavioral8
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240611-en
Max time kernel
1794s
Max time network
1800s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 736 wrote to memory of 2284 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 736 wrote to memory of 2284 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4296,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:8
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4316,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 131.253.33.237:443 | g.bing.com | tcp |
| BE | 88.221.83.178:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 237.33.253.131.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/2284-14-0x000001DDF4A00000-0x000001DDF4A20000-memory.dmp
memory/2284-15-0x000001DE86DC0000-0x000001DE86DE0000-memory.dmp
memory/2284-16-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-18-0x000001DE87430000-0x000001DE87450000-memory.dmp
memory/2284-17-0x000001DE87410000-0x000001DE87430000-memory.dmp
memory/2284-19-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-20-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-23-0x000001DE87430000-0x000001DE87450000-memory.dmp
memory/2284-22-0x000001DE87410000-0x000001DE87430000-memory.dmp
memory/2284-21-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-24-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-25-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-26-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-27-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-28-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-29-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-30-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-31-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-32-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-33-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-34-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-35-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-36-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-37-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-38-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-39-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-40-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-41-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-42-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-43-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-44-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-45-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-46-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-47-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-48-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-49-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-50-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-51-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-52-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-53-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-54-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-55-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-56-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-57-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-58-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-59-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-60-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-61-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-62-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-63-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-64-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-65-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-66-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-67-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-68-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-69-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-70-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-71-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-72-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-73-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-74-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-75-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-76-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-77-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-78-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-79-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-80-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-81-0x00007FF720500000-0x00007FF721003000-memory.dmp
memory/2284-82-0x00007FF720500000-0x00007FF721003000-memory.dmp
Analysis: behavioral9
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1782s
Max time network
1727s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
Files
Analysis: behavioral14
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1792s
Max time network
1794s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1888 wrote to memory of 4532 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 1888 wrote to memory of 4532 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| BE | 88.221.83.226:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 35.15.31.184.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 85.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/4532-14-0x0000019BA3330000-0x0000019BA3350000-memory.dmp
memory/4532-15-0x0000019BA34C0000-0x0000019BA34E0000-memory.dmp
memory/4532-16-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-18-0x0000019BA3500000-0x0000019BA3520000-memory.dmp
memory/4532-17-0x0000019BA34E0000-0x0000019BA3500000-memory.dmp
memory/4532-19-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-20-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-21-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-22-0x0000019BA34E0000-0x0000019BA3500000-memory.dmp
memory/4532-23-0x0000019BA3500000-0x0000019BA3520000-memory.dmp
memory/4532-24-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-25-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-26-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-27-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-28-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-29-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-30-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-31-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-32-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-33-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-34-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-35-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-36-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-37-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-38-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-39-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-40-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-41-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-42-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-43-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-44-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-45-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-46-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-47-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-48-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-49-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-50-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-51-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-52-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-53-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-54-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-55-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-56-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-57-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-58-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-59-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-60-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-61-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-62-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-63-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-64-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-65-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-66-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-67-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-68-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-69-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-70-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-71-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-72-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-73-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-74-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-75-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-76-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-77-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-78-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-79-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-80-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-81-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
memory/4532-82-0x00007FF6AF120000-0x00007FF6AFC23000-memory.dmp
Analysis: behavioral7
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1568s
Max time network
1582s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
Files
Analysis: behavioral11
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1792s
Max time network
1799s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4488 wrote to memory of 3560 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 4488 wrote to memory of 3560 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| BE | 88.221.83.192:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.162.46.104.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/3560-14-0x000002B3D2AB0000-0x000002B3D2AD0000-memory.dmp
memory/3560-15-0x000002B3D2C00000-0x000002B3D2C20000-memory.dmp
memory/3560-16-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-17-0x000002B466EB0000-0x000002B466ED0000-memory.dmp
memory/3560-18-0x000002B3D2C20000-0x000002B3D2C40000-memory.dmp
memory/3560-19-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-20-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-21-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-23-0x000002B3D2C20000-0x000002B3D2C40000-memory.dmp
memory/3560-22-0x000002B466EB0000-0x000002B466ED0000-memory.dmp
memory/3560-24-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-25-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-26-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-27-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-28-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-29-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-30-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-31-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-32-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-33-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-34-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-35-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-36-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-37-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-38-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-39-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-40-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-41-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-42-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-43-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-44-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-45-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-46-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-47-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-48-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-49-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-50-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-51-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-52-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-53-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-54-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-55-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-56-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-57-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-58-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-59-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-60-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-61-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-62-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-63-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-64-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-65-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-66-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-67-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-68-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-69-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-70-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-71-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-72-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-73-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-74-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-75-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-76-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-77-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-78-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-79-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-80-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-81-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
memory/3560-82-0x00007FF6D80A0000-0x00007FF6D8BA3000-memory.dmp
Analysis: behavioral12
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1794s
Max time network
1797s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4548 wrote to memory of 2152 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 4548 wrote to memory of 2152 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| BE | 2.17.107.131:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 133.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.109.133:443 | objects.githubusercontent.com | tcp |
| BE | 2.17.107.131:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.109.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 227.162.46.104.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/2152-14-0x000002752EE50000-0x000002752EE70000-memory.dmp
memory/2152-15-0x00000275C2930000-0x00000275C2950000-memory.dmp
memory/2152-16-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-18-0x00000275C2F90000-0x00000275C2FB0000-memory.dmp
memory/2152-17-0x00000275C2FB0000-0x00000275C2FD0000-memory.dmp
memory/2152-19-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-20-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-23-0x00000275C2F90000-0x00000275C2FB0000-memory.dmp
memory/2152-22-0x00000275C2FB0000-0x00000275C2FD0000-memory.dmp
memory/2152-21-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-24-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-25-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-26-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-27-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-28-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-29-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-30-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-31-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-32-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-33-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-34-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-35-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-36-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-37-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-38-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-39-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-40-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-41-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-42-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-43-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-44-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-45-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-46-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-47-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-48-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-49-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-50-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-51-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-52-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-53-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-54-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-55-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-56-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-57-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-58-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-59-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-60-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-61-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-62-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-63-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-64-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-65-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-66-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-67-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-68-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-69-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-70-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-71-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-72-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-73-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-74-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-75-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-76-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-77-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-78-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-79-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-80-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-81-0x00007FF724130000-0x00007FF724C33000-memory.dmp
memory/2152-82-0x00007FF724130000-0x00007FF724C33000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1652s
Max time network
1665s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1773s
Max time network
1785s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| US | 52.111.227.11:443 | tcp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1796s
Max time network
1802s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:23
Platform
win10v2004-20240508-en
Max time kernel
1603s
Max time network
1616s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
Files
Analysis: behavioral10
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1794s
Max time network
1796s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1568 wrote to memory of 1268 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 1568 wrote to memory of 1268 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| BE | 2.17.107.131:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | 145.83.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| BE | 2.17.107.131:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 45.76.89.70:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 70.89.76.45.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 201.201.50.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/1268-14-0x000001CDA3B30000-0x000001CDA3B50000-memory.dmp
memory/1268-15-0x000001CDA5440000-0x000001CDA5460000-memory.dmp
memory/1268-16-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-18-0x000001CDA5480000-0x000001CDA54A0000-memory.dmp
memory/1268-17-0x000001CDA5460000-0x000001CDA5480000-memory.dmp
memory/1268-19-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-20-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-23-0x000001CDA5480000-0x000001CDA54A0000-memory.dmp
memory/1268-22-0x000001CDA5460000-0x000001CDA5480000-memory.dmp
memory/1268-21-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-24-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-25-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-26-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-27-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-28-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-29-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-30-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-31-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-32-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-33-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-34-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-35-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-36-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-37-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-38-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-39-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-40-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-41-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-42-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-43-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-44-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-45-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-46-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-47-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-48-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-49-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-50-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-51-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-52-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-53-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-54-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-55-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-56-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-57-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-58-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-59-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-60-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-61-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-62-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-63-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-64-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-65-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-66-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-67-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-68-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-69-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-70-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-71-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-72-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-73-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-74-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-75-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-76-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-77-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-78-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-79-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-80-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-81-0x00007FF665250000-0x00007FF665D53000-memory.dmp
memory/1268-82-0x00007FF665250000-0x00007FF665D53000-memory.dmp
Analysis: behavioral15
Detonation Overview
Submitted
2024-06-13 09:37
Reported
2024-06-13 10:25
Platform
win10v2004-20240611-en
Max time kernel
1796s
Max time network
1800s
Command Line
Signatures
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 | C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e | C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
| Token: SeLockMemoryPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2636 wrote to memory of 1332 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
| PID 2636 wrote to memory of 1332 | N/A | C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe | C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe
"C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe"
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4556,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3984,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | objects.githubusercontent.com | udp |
| US | 185.199.108.133:443 | objects.githubusercontent.com | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 215.156.26.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pool.hashvault.pro | udp |
| DE | 95.179.241.203:80 | pool.hashvault.pro | tcp |
| US | 8.8.8.8:53 | 203.241.179.95.in-addr.arpa | udp |
| GB | 52.123.242.9:443 | tcp | |
| GB | 52.123.242.49:443 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.143.182.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 12.242.123.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 125.162.192.69.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
| MD5 | e2fe87cc2c7dab8ca6516620dccd1381 |
| SHA1 | f714ec0448325435103519452610cf7aadf8bbba |
| SHA256 | d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4 |
| SHA512 | 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6 |
memory/1332-14-0x000001F49EC00000-0x000001F49EC20000-memory.dmp
memory/1332-15-0x000001F4A0400000-0x000001F4A0420000-memory.dmp
memory/1332-16-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-18-0x000001F4A0440000-0x000001F4A0460000-memory.dmp
memory/1332-17-0x000001F4A0420000-0x000001F4A0440000-memory.dmp
memory/1332-19-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-20-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-21-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-22-0x000001F4A0420000-0x000001F4A0440000-memory.dmp
memory/1332-23-0x000001F4A0440000-0x000001F4A0460000-memory.dmp
memory/1332-24-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-25-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-26-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-27-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-28-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-29-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-30-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-31-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-32-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-33-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-34-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-35-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-36-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-37-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-38-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-39-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-40-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-41-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-42-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-43-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-44-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-45-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-46-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-47-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-48-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-49-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-50-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-51-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-52-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-53-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-54-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-55-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-56-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-57-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-58-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-59-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-60-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-61-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-62-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-63-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-64-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-65-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-66-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-67-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-68-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-69-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-70-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-71-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-72-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-73-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-74-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-75-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-76-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-77-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-78-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-79-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-80-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-81-0x00007FF710F70000-0x00007FF711A73000-memory.dmp
memory/1332-82-0x00007FF710F70000-0x00007FF711A73000-memory.dmp