Behavioral task
behavioral1
Sample
d595038d90a3d16775ab67e8696c00a72e718bf0833cd43bf5bac386ceed0ac9N.exe
Resource
win7-20240704-en
General
-
Target
d595038d90a3d16775ab67e8696c00a72e718bf0833cd43bf5bac386ceed0ac9N
-
Size
1.8MB
-
MD5
a9b488379a0f9bdf13dc624bfebcbff0
-
SHA1
bdab5b05b48f6a685d99d7952b8e8cb7c2346c27
-
SHA256
d595038d90a3d16775ab67e8696c00a72e718bf0833cd43bf5bac386ceed0ac9
-
SHA512
4829300aabf6c893902fce7426c3518844529adf70e1c82c54bf2bb7e2f8f1a0284403ad41c4c1d495a3206df351515de7e4c7ea60abb6ebcd15296f9dcfaca2
-
SSDEEP
49152:GezaTF8FcNkNdfE0pZ9oztFwIi5aIwC+Agr6S/Fattzk2:GemTLkNdfE0pZaQB
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule sample family_kpot -
Kpot family
-
XMRig Miner payload 1 IoCs
Processes:
resource yara_rule sample xmrig -
Xmrig family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d595038d90a3d16775ab67e8696c00a72e718bf0833cd43bf5bac386ceed0ac9N
Files
-
d595038d90a3d16775ab67e8696c00a72e718bf0833cd43bf5bac386ceed0ac9N.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 619KB - Virtual size: 619KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ