Analysis
-
max time kernel
99s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 09:31
Behavioral task
behavioral1
Sample
6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe
Resource
win7-20241010-en
General
-
Target
6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe
-
Size
784KB
-
MD5
6fb15f7bb81a9a440fe07e1064df8330
-
SHA1
8db390dd910e34be5abbdac5d9237b3fff655785
-
SHA256
6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611
-
SHA512
62e2fa62f6f207baacf35b77c0a987a02d2b7c8eb652237fcb8ecf6c001dd17a406fd56a32f11c969a21405201eb5f2275f799fb7ba780ae92ea88a247707bdc
-
SSDEEP
12288:4NZEo3/v6xUP6jWgGVXgBLp6zwzdKcxN7FkXbCusjfBSneyenDZAEpu9nUpKp:qEg0RWpQ1MlrL+fIn9UyEwJUo
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 6 IoCs
resource yara_rule behavioral2/memory/4396-2-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/4396-12-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/4848-15-0x0000000000400000-0x0000000000593000-memory.dmp xmrig behavioral2/memory/4848-20-0x0000000005480000-0x0000000005613000-memory.dmp xmrig behavioral2/memory/4848-21-0x0000000000400000-0x0000000000587000-memory.dmp xmrig behavioral2/memory/4848-31-0x0000000000400000-0x0000000000587000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 4848 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe -
Executes dropped EXE 1 IoCs
pid Process 4848 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe -
resource yara_rule behavioral2/memory/4396-0-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/memory/4848-13-0x0000000000400000-0x0000000000712000-memory.dmp upx behavioral2/files/0x000b000000023b69-11.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4396 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4396 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe 4848 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4396 wrote to memory of 4848 4396 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe 85 PID 4396 wrote to memory of 4848 4396 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe 85 PID 4396 wrote to memory of 4848 4396 6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe"C:\Users\Admin\AppData\Local\Temp\6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exeC:\Users\Admin\AppData\Local\Temp\6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:4848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6eaf207ee25a98617758595f75fa80680ae250911c4f0a96c2f8907901ba8611N.exe
Filesize784KB
MD5d919729fb55a01e8799195f2a80929d4
SHA1216d0933e72f02ebb6678acb99513a37c46a8bd6
SHA256ecad16be86f76d3f96b2565480f5fcc33a913c81c826f979e20f1cc9e2dbf6f9
SHA51211ec3492a5c8b9c3b212a83f398d96c57804478b83f44f00c732f767a0ad3e82af14733512d6d471f4f370b26805281e0f1eb9a101b1c8c760262bdd3ee4896b