Analysis
- max time kernel
110s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
24/07/2024, 11:07
General
- Target 79f9f18b085db084f947c194c7634b90N.exe
- Size 5.2MB
- Sample240724-m77chawemc
- SHA256 2b4f4367b7d29186e8f03c996f3ff0d47abcebe30aba884c91a152aa5a19d53c
Malware Config
Signatures
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 11 IoCs
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79f9f18b085db084f947c194c7634b90N.exe"C:\Users\Admin\AppData\Local\Temp\79f9f18b085db084f947c194c7634b90N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3524-0-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-1-0x0000024078A30000-0x0000024078A40000-memory.dmp
memory/3524-2-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-3-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-4-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-5-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-6-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-7-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-8-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-9-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-10-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-11-0x00007FF64E330000-0x00007FF64E681000-memory.dmp
memory/3524-12-0x00007FF64E330000-0x00007FF64E681000-memory.dmp