Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 23:15
Behavioral task
behavioral1
Sample
a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe
-
Size
1.6MB
-
MD5
c41b3a6c0a3124e3ba8bdf6aa10fb160
-
SHA1
071ac18519f64600a9a8857cfbffb386f4cc9bad
-
SHA256
a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3
-
SHA512
f4cf34aa5ed1ec906c0f19d03b2cbd858b1a9f87f99ac9eb0a01db960db30ff77fa9d789751b4771d7e88010d111660bf8e0a7b675d1d4d2e57794af9b379642
-
SSDEEP
24576:8avo/YFhnivTP0lhLuFEFotb0XUGH0gUu2ZfdOPAklQuYi/XInG:8Eo/Ul0atGYUGHv92ZfY5l3j/f
Malware Config
Signatures
-
XMRig Miner payload 15 IoCs
resource yara_rule behavioral1/memory/1804-4-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-5-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-8-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-9-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-10-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-11-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-12-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-13-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-14-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-15-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-16-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-17-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-18-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-19-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig behavioral1/memory/1804-20-0x000000013F8B0000-0x000000013FFF1000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/1804-0-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-4-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-5-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-8-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-9-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-10-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-11-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-12-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-13-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-14-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-15-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-16-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-17-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-18-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-19-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx behavioral1/memory/1804-20-0x000000013F8B0000-0x000000013FFF1000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 460 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe Token: SeLockMemoryPrivilege 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1804 a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe"C:\Users\Admin\AppData\Local\Temp\a8038dcfdf316363b30df71f2bab457b55d2a505d86cdf6a40aaa6b3def81ef3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1804