Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:47

Platform

win10v2004-20240508-en

Max time kernel

1792s

Max time network

1800s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:43

Platform

win10v2004-20240508-en

Max time kernel

1714s

Max time network

1727s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:45

Platform

win10v2004-20240508-en

Max time kernel

1792s

Max time network

1799s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3760,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:47

Platform

win10v2004-20240508-en

Max time kernel

1724s

Max time network

1736s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:49

Platform

win10v2004-20240508-en

Max time kernel

1769s

Max time network

1782s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:49

Platform

win10v2004-20240611-en

Max time kernel

1792s

Max time network

1794s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4708 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 4708 wrote to memory of 5104	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	218.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	138.201.86.20.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	90.65.42.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/5104-14-0x000001CAB6D90000-0x000001CAB6DB0000-memory.dmp

memory/5104-15-0x000001CAB6DD0000-0x000001CAB6DF0000-memory.dmp

memory/5104-16-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-17-0x000001CAB6DF0000-0x000001CAB6E10000-memory.dmp

memory/5104-18-0x000001CAB6E10000-0x000001CAB6E30000-memory.dmp

memory/5104-19-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-20-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-21-0x000001CAB6DF0000-0x000001CAB6E10000-memory.dmp

memory/5104-23-0x000001CAB6E10000-0x000001CAB6E30000-memory.dmp

memory/5104-22-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-24-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-25-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-26-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-27-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-28-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-29-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-30-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-31-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-32-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-33-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-34-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-35-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-36-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-37-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-38-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-39-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-40-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-41-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-42-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-43-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-44-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-45-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-46-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-47-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-48-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-49-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-50-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-51-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-52-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-53-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-54-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-55-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-56-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-57-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-58-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-59-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-60-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-61-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-62-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-63-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-64-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-65-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-66-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-67-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-68-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-69-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-70-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-71-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-72-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-73-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-74-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-75-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-76-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-77-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-78-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-79-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-80-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-81-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

memory/5104-82-0x00007FF6A93A0000-0x00007FF6A9EA3000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:53

Platform

win10v2004-20240611-en

Max time kernel

1791s

Max time network

1801s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1192 wrote to memory of 4904	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 1192 wrote to memory of 4904	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	200.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	103.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	90.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	26.178.89.13.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/4904-14-0x0000022752280000-0x00000227522A0000-memory.dmp

memory/4904-15-0x0000022753A80000-0x0000022753AA0000-memory.dmp

memory/4904-16-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-17-0x0000022753AA0000-0x0000022753AC0000-memory.dmp

memory/4904-18-0x00000227E6470000-0x00000227E6490000-memory.dmp

memory/4904-19-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-20-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-23-0x00000227E6470000-0x00000227E6490000-memory.dmp

memory/4904-22-0x0000022753AA0000-0x0000022753AC0000-memory.dmp

memory/4904-21-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-24-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-25-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-26-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-27-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-28-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-29-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-30-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-31-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-32-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-33-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-34-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-35-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-36-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-37-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-38-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-39-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-40-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-41-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-42-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-43-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-44-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-45-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-46-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-47-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-48-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-49-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-50-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-51-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-52-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-53-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-54-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-55-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-56-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-57-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-58-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-59-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-60-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-61-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-62-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-63-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-64-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-65-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-66-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-67-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-68-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-69-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-70-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-71-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-72-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-73-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-74-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-75-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-76-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-77-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-78-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-79-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-80-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-81-0x00007FF750B00000-0x00007FF751603000-memory.dmp

memory/4904-82-0x00007FF750B00000-0x00007FF751603000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:42

Platform

win10v2004-20240508-en

Max time kernel

1657s

Max time network

1669s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:45

Platform

win10v2004-20240508-en

Max time kernel

1687s

Max time network

1699s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:48

Platform

win10v2004-20240226-en

Max time kernel

1795s

Max time network

1812s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe	N/A

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\svchost.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4208 wrote to memory of 4944	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 4208 wrote to memory of 4944	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.109.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.109.199.185.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	172.217.169.42:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	154.239.44.20.in-addr.arpa	udp
US	8.8.8.8:53	42.169.217.172.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	123.10.44.20.in-addr.arpa	udp
US	8.8.8.8:53	16.43.107.13.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	68.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	www.microsoft.com	udp
SE	23.34.233.128:80	www.microsoft.com	tcp
US	8.8.8.8:53	241.154.82.20.in-addr.arpa	udp
US	8.8.8.8:53	128.233.34.23.in-addr.arpa	udp
US	8.8.8.8:53	198.32.209.4.in-addr.arpa	udp
US	8.8.8.8:53	163.233.34.23.in-addr.arpa	udp
US	8.8.8.8:53	98.233.34.23.in-addr.arpa	udp
US	8.8.8.8:53	119.110.54.20.in-addr.arpa	udp
US	8.8.8.8:53	25.14.97.104.in-addr.arpa	udp
US	8.8.8.8:53	50.14.97.104.in-addr.arpa	udp
US	8.8.8.8:53	217.135.221.88.in-addr.arpa	udp
US	8.8.8.8:53	248.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	211.14.97.104.in-addr.arpa	udp
US	8.8.8.8:53	21.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	208.197.17.2.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/4944-16-0x000001B901A10000-0x000001B901A30000-memory.dmp

memory/4944-17-0x000001B903300000-0x000001B903320000-memory.dmp

memory/4944-18-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-19-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-21-0x000001B903320000-0x000001B903340000-memory.dmp

memory/4944-20-0x000001B903340000-0x000001B903360000-memory.dmp

memory/4944-22-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-23-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-24-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-25-0x000001B903340000-0x000001B903360000-memory.dmp

memory/4944-26-0x000001B903320000-0x000001B903340000-memory.dmp

memory/4944-27-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-28-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-29-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-30-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-31-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-32-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-33-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-34-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-35-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-36-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-37-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-38-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-39-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-40-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-41-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-42-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-43-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-44-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-45-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-46-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-47-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-48-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-49-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-50-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-51-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-52-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-53-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-54-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-55-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-56-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-57-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-58-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-59-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-60-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-61-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-62-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-63-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-64-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-65-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-66-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-67-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-68-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-69-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-70-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-71-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-72-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-73-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-74-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-75-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-76-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-77-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-78-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-79-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-80-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-81-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-82-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-83-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

memory/4944-84-0x00007FF60C1A0000-0x00007FF60CCA3000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:52

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1783s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2140 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 2140 wrote to memory of 2580	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	133.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
BE	23.41.178.67:443	www.bing.com	tcp
US	8.8.8.8:53	195.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.110.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	133.110.199.185.in-addr.arpa	udp
US	8.8.8.8:53	67.178.41.23.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	100.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	29.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	26.178.89.13.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/2580-14-0x000001FAD26A0000-0x000001FAD26C0000-memory.dmp

memory/2580-15-0x000001FAD3EB0000-0x000001FAD3ED0000-memory.dmp

memory/2580-16-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-18-0x000001FAD3EF0000-0x000001FAD3F10000-memory.dmp

memory/2580-17-0x000001FAD3ED0000-0x000001FAD3EF0000-memory.dmp

memory/2580-19-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-20-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-23-0x000001FAD3EF0000-0x000001FAD3F10000-memory.dmp

memory/2580-22-0x000001FAD3ED0000-0x000001FAD3EF0000-memory.dmp

memory/2580-21-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-24-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-25-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-26-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-27-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-28-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-29-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-30-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-31-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-32-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-33-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-34-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-35-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-36-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-37-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-38-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-39-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-40-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-41-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-42-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-43-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-44-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-45-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-46-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-47-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-48-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-49-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-50-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-51-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-52-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-53-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-54-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-55-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-56-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-57-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-58-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-59-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-60-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-61-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-62-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-63-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-64-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-65-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-66-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-67-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-68-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-69-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-70-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-71-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-72-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-73-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-74-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-75-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-76-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-77-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-78-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-79-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-80-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-81-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

memory/2580-82-0x00007FF6050E0000-0x00007FF605BE3000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:40

Platform

win10v2004-20240611-en

Max time kernel

1792s

Max time network

1791s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5072 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 5072 wrote to memory of 4480	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
NL	23.62.61.155:443	www.bing.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	68.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	155.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	216.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	66.112.168.52.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/4480-14-0x000001CE82960000-0x000001CE82980000-memory.dmp

memory/4480-15-0x000001CE842A0000-0x000001CE842C0000-memory.dmp

memory/4480-16-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-18-0x000001CE842E0000-0x000001CE84300000-memory.dmp

memory/4480-17-0x000001CE842C0000-0x000001CE842E0000-memory.dmp

memory/4480-19-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-20-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-23-0x000001CE842E0000-0x000001CE84300000-memory.dmp

memory/4480-22-0x000001CE842C0000-0x000001CE842E0000-memory.dmp

memory/4480-21-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-24-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-25-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-26-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-27-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-28-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-29-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-30-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-31-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-32-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-33-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-34-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-35-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-36-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-37-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-38-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-39-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-40-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-41-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-42-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-43-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-44-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-45-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-46-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-47-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-48-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-49-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-50-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-51-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-52-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-53-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-54-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-55-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-56-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-57-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-58-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-59-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-60-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-61-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-62-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-63-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-64-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-65-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-66-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-67-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-68-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-69-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-70-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-71-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-72-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-73-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-74-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-75-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-76-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-77-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-78-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-79-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-80-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-81-0x00007FF690380000-0x00007FF690E83000-memory.dmp

memory/4480-82-0x00007FF690380000-0x00007FF690E83000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:47

Platform

win10v2004-20240226-en

Max time kernel

1795s

Max time network

1803s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe	N/A

Suspicious behavior: LoadsDriver

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1532 wrote to memory of 4968	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 1532 wrote to memory of 4968	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	241.150.49.20.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	45.76.89.70:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	70.89.76.45.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
GB	142.250.187.202:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	pki.goog	udp
US	8.8.8.8:53	pki.goog	udp
US	216.239.32.29:80	pki.goog	tcp
US	8.8.8.8:53	29.32.239.216.in-addr.arpa	udp
US	8.8.8.8:53	202.187.250.142.in-addr.arpa	udp
US	13.107.246.64:443		tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	209.205.72.20.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	211.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	234.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	4.173.189.20.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	164.189.21.2.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/4968-16-0x000002A61CC20000-0x000002A61CC40000-memory.dmp

memory/4968-17-0x000002A61E420000-0x000002A61E440000-memory.dmp

memory/4968-18-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-19-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-20-0x000002A61E440000-0x000002A61E460000-memory.dmp

memory/4968-21-0x000002A61E460000-0x000002A61E480000-memory.dmp

memory/4968-22-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-23-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-26-0x000002A61E460000-0x000002A61E480000-memory.dmp

memory/4968-25-0x000002A61E440000-0x000002A61E460000-memory.dmp

memory/4968-24-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-27-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-28-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-29-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-30-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-31-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-32-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-33-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-34-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-35-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-36-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-37-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-38-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-39-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-40-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-41-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-42-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-43-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-44-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-45-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-46-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-47-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-48-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-49-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-50-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-51-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-52-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-53-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-54-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-55-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-56-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-57-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-58-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-59-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-60-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-61-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-62-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-63-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-64-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-65-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-66-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-67-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-68-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-69-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-70-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-71-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-72-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-73-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-74-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-75-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-76-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-77-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-78-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-79-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-80-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-81-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-82-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-83-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

memory/4968-84-0x00007FF645BD0000-0x00007FF6466D3000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:52

Platform

win10v2004-20240611-en

Max time kernel

1792s

Max time network

1803s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2668 wrote to memory of 788	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 2668 wrote to memory of 788	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=760,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
NL	23.62.61.129:443	www.bing.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	129.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	183.59.114.20.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	200.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	0.205.248.87.in-addr.arpa	udp
US	8.8.8.8:53	10.73.50.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/788-14-0x000001D6ADD80000-0x000001D6ADDA0000-memory.dmp

memory/788-15-0x000001D6ADDE0000-0x000001D6ADE00000-memory.dmp

memory/788-16-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-17-0x000001D741F60000-0x000001D741F80000-memory.dmp

memory/788-18-0x000001D741F80000-0x000001D741FA0000-memory.dmp

memory/788-19-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-20-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-23-0x000001D741F80000-0x000001D741FA0000-memory.dmp

memory/788-22-0x000001D741F60000-0x000001D741F80000-memory.dmp

memory/788-21-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-24-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-25-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-26-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-27-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-28-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-29-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-30-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-31-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-32-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-33-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-34-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-35-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-36-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-37-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-38-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-39-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-40-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-41-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-42-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-43-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-44-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-45-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-46-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-47-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-48-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-49-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-50-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-51-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-52-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-53-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-54-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-55-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-56-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-57-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-58-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-59-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-60-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-61-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-62-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-63-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-64-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-65-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-66-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-67-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-68-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-69-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-70-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-71-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-72-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-73-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-74-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-75-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-76-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-77-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-78-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-79-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-80-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-81-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

memory/788-82-0x00007FF6FA9A0000-0x00007FF6FB4A3000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:54

Platform

win10v2004-20240508-en

Max time kernel

1699s

Max time network

1712s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:55

Platform

win10v2004-20240508-en

Max time kernel

1736s

Max time network

1748s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	github.com	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:55

Platform

win10v2004-20240611-en

Max time kernel

1792s

Max time network

1797s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main.exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 428 wrote to memory of 644	N/A	C:\Users\Admin\AppData\Local\Temp\main.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 428 wrote to memory of 644	N/A	C:\Users\Admin\AppData\Local\Temp\main.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main.exe

"C:\Users\Admin\AppData\Local\Temp\main.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
BE	23.41.178.58:443	www.bing.com	tcp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	20.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	58.178.41.23.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	45.76.89.70:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	70.89.76.45.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	130.211.222.173.in-addr.arpa	udp
US	8.8.8.8:53	83.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	200.201.50.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/644-14-0x0000020511710000-0x0000020511730000-memory.dmp

memory/644-15-0x0000020512F00000-0x0000020512F20000-memory.dmp

memory/644-16-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-18-0x0000020512F20000-0x0000020512F40000-memory.dmp

memory/644-17-0x0000020512F40000-0x0000020512F60000-memory.dmp

memory/644-19-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-20-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-23-0x0000020512F20000-0x0000020512F40000-memory.dmp

memory/644-22-0x0000020512F40000-0x0000020512F60000-memory.dmp

memory/644-21-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-24-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-25-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-26-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-27-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-28-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-29-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-30-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-31-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-32-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-33-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-34-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-35-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-36-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-37-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-38-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-39-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-40-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-41-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-42-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-43-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-44-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-45-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-46-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-47-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-48-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-49-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-50-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-51-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-52-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-53-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-54-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-55-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-56-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-57-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-58-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-59-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-60-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-61-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-62-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-63-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-64-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-65-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-66-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-67-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-68-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-69-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-70-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-71-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-72-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-73-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-74-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-75-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-76-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-77-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-78-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-79-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-80-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-81-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

memory/644-82-0x00007FF6C6C20000-0x00007FF6C7723000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:40

Platform

win10v2004-20240611-en

Max time kernel

1794s

Max time network

1802s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1072 wrote to memory of 1172	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 1072 wrote to memory of 1172	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	2.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	240.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.109.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	133.109.199.185.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	195.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	209.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	12.173.189.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/1172-14-0x000002688BB30000-0x000002688BB50000-memory.dmp

memory/1172-15-0x000002688D290000-0x000002688D2B0000-memory.dmp

memory/1172-16-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-17-0x000002691FC70000-0x000002691FC90000-memory.dmp

memory/1172-18-0x000002688D2B0000-0x000002688D2D0000-memory.dmp

memory/1172-19-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-20-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-22-0x000002688D2B0000-0x000002688D2D0000-memory.dmp

memory/1172-21-0x000002691FC70000-0x000002691FC90000-memory.dmp

memory/1172-23-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-24-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-25-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-26-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-27-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-28-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-29-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-30-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-31-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-32-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-33-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-34-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-35-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-36-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-37-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-38-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-39-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-40-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-41-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-42-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-43-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-44-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-45-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-46-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-47-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-48-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-49-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-50-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-51-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-52-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-53-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-54-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-55-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-56-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-57-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-58-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-59-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-60-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-61-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-62-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-63-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-64-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-65-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-66-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-67-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-68-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-69-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-70-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-71-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-72-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-73-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-74-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-75-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-76-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-77-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-78-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-79-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-80-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-81-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

memory/1172-82-0x00007FF6DE380000-0x00007FF6DEE83000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:45

Platform

win10v2004-20240611-en

Max time kernel

1792s

Max time network

1799s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3836 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 3836 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	github.com	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	234.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	95.179.241.203:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	203.241.179.95.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	89.65.42.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/1584-14-0x0000025867EA0000-0x0000025867EC0000-memory.dmp

memory/1584-15-0x0000025867EF0000-0x0000025867F10000-memory.dmp

memory/1584-16-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-17-0x00000258696F0000-0x0000025869710000-memory.dmp

memory/1584-18-0x00000258696D0000-0x00000258696F0000-memory.dmp

memory/1584-19-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-20-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-23-0x00000258696D0000-0x00000258696F0000-memory.dmp

memory/1584-22-0x00000258696F0000-0x0000025869710000-memory.dmp

memory/1584-21-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-24-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-25-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-26-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-27-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-28-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-29-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-30-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-31-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-32-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-33-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-34-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-35-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-36-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-37-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-38-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-39-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-40-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-41-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-42-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-43-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-44-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-45-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-46-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-47-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-48-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-49-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-50-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-51-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-52-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-53-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-54-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-55-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-56-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-57-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-58-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-59-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-60-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-61-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-62-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-63-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-64-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-65-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-66-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-67-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-68-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-69-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-70-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-71-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-72-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-73-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-74-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-75-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-76-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-77-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-78-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-79-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-80-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-81-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

memory/1584-82-0x00007FF649FD0000-0x00007FF64AAD3000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-13 16:46

Reported

2024-06-13 17:49

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1797s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe"

Signatures

XMRig Miner payload

miner

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

xmrig

miner xmrig

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Modifies system certificate store

evasion spyware trojan

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe	N/A
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A
Token: SeLockMemoryPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4592 wrote to memory of 3552	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 4592 wrote to memory of 3552	N/A	C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe	C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	github.com	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
GB	20.26.156.215:443	github.com	tcp
US	8.8.8.8:53	objects.githubusercontent.com	udp
US	185.199.108.133:443	objects.githubusercontent.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	215.156.26.20.in-addr.arpa	udp
US	8.8.8.8:53	pool.hashvault.pro	udp
DE	45.76.89.70:80	pool.hashvault.pro	tcp
US	8.8.8.8:53	133.108.199.185.in-addr.arpa	udp
US	8.8.8.8:53	70.89.76.45.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	31.121.18.2.in-addr.arpa	udp
US	8.8.8.8:53	209.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	249.197.17.2.in-addr.arpa	udp
US	8.8.8.8:53	168.117.168.52.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5	e2fe87cc2c7dab8ca6516620dccd1381
SHA1	f714ec0448325435103519452610cf7aadf8bbba
SHA256	d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512	8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/3552-14-0x00000162DF3F0000-0x00000162DF410000-memory.dmp

memory/3552-15-0x00000162DF440000-0x00000162DF460000-memory.dmp

memory/3552-16-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-18-0x00000162E0C10000-0x00000162E0C30000-memory.dmp

memory/3552-17-0x00000162E0C30000-0x00000162E0C50000-memory.dmp

memory/3552-19-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-20-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-23-0x00000162E0C10000-0x00000162E0C30000-memory.dmp

memory/3552-22-0x00000162E0C30000-0x00000162E0C50000-memory.dmp

memory/3552-21-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-24-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-25-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-26-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-27-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-28-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-29-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-30-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-31-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-32-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-33-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-34-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-35-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-36-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-37-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-38-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-39-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-40-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-41-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-42-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-43-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-44-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-45-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-46-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-47-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-48-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-49-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-50-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-51-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-52-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-53-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-54-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-55-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-56-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-57-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-58-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-59-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-60-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-61-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-62-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-63-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-64-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-65-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-66-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-67-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-68-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-69-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-70-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-71-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-72-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-73-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-74-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-75-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-76-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-77-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-78-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-79-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-80-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-81-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

memory/3552-82-0x00007FF7160C0000-0x00007FF716BC3000-memory.dmp

Sample ID	240613-t9y78s1bkk
Target	packer.zip
SHA256	2712cfc84e57a8c2c3637bc69d65c1741fcb7a600c78709bbe3d47c5f76a4293
Tags	xmrig miner

Malware Analysis Report

2024-07-28 19:31

Table of Contents

Analysis Overview

Threat Level: Known bad