Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16-07-2024 03:14
Behavioral task
behavioral1
Sample
5b9e9710c64cc5692e4dfe30a3da37a0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
5b9e9710c64cc5692e4dfe30a3da37a0N.exe
-
Size
1.6MB
-
MD5
5b9e9710c64cc5692e4dfe30a3da37a0
-
SHA1
5aa1aff1c51c457fabbb5d21cf01c9e282f0017f
-
SHA256
e8e7e79ae4be77e5e6726e4d226d02c651ad19873d34f18661c574958e211794
-
SHA512
2c8bd7d311f4cc0d7c6b815b6d8b8c7e144600e22d8e431ae220bee26dddb79152090728090258dccd9c87fa9696df2eb40e5f8b4d155d530f7c566207a2975b
-
SSDEEP
49152:Or36QVBLLnPj35GLMC2jgNGZ8+JzCc+1:Ob6efVj1tk
Malware Config
Signatures
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/2764-4-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-5-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-6-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-7-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-10-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-11-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-12-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-13-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-14-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-15-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-16-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig behavioral1/memory/2764-17-0x000000013F600000-0x000000013FD45000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/2764-0-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-4-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-5-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-6-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-7-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-10-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-11-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-12-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-13-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-14-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-15-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-16-0x000000013F600000-0x000000013FD45000-memory.dmp upx behavioral1/memory/2764-17-0x000000013F600000-0x000000013FD45000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe Token: SeLockMemoryPrivilege 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2764 5b9e9710c64cc5692e4dfe30a3da37a0N.exe