Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
09/07/2024, 18:14
General
-
Target
962e9a7e391ed22b6567bc43ea2e2e9e8e8750601562a8356ffcb15c649a3ca0.exe
-
Size
2.5MB
-
MD5
00a69916c649b8f347552f045d9529ef
-
SHA1
834062535c07857f99732e009358373a9321036a
-
SHA256
962e9a7e391ed22b6567bc43ea2e2e9e8e8750601562a8356ffcb15c649a3ca0
-
SHA512
423bc39fcdeeb56ed1449191bcc96607cbd43652ec2589cb810055d48db4769d8789001383b9db95beb36744b38057537e0a8bcff999874dd69c4b18c21b9172
-
SSDEEP
49152:MBeicQuxzs62GFUQsRALUKbtr4y8X2GcIqHwE2:MBeXxYAcAL5r4y8XqwE
Malware Config
Signatures
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 9 IoCs
-
Creates new service(s) 2 TTPs
-
Stops running service(s) 4 TTPs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 2 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\962e9a7e391ed22b6567bc43ea2e2e9e8e8750601562a8356ffcb15c649a3ca0.exe"C:\Users\Admin\AppData\Local\Temp\962e9a7e391ed22b6567bc43ea2e2e9e8e8750601562a8356ffcb15c649a3ca0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "Windows.Services"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "Windows.Services" binpath= "C:\ProgramData\system_services.exe" start= "auto"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "Windows.Services"2⤵
- Launches sc.exe
-
-
C:\ProgramData\system_services.exeC:\ProgramData\system_services.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD500a69916c649b8f347552f045d9529ef
SHA1834062535c07857f99732e009358373a9321036a
SHA256962e9a7e391ed22b6567bc43ea2e2e9e8e8750601562a8356ffcb15c649a3ca0
SHA512423bc39fcdeeb56ed1449191bcc96607cbd43652ec2589cb810055d48db4769d8789001383b9db95beb36744b38057537e0a8bcff999874dd69c4b18c21b9172
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
128KB
-
Filesize
8.3MB
-
Filesize
8.3MB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
52KB