Resubmissions
12/11/2024, 13:18
241112-qkdnfsslgy 1012/11/2024, 13:18
241112-qjzjjatdje 1012/11/2024, 13:17
241112-qjdbastcpl 1012/11/2024, 12:45
241112-py23jashmd 1012/11/2024, 12:44
241112-pygrlawldk 1012/11/2024, 06:05
241112-gtdv5swgqe 1011/11/2024, 10:56
241111-m17dxsxpcs 1010/11/2024, 18:23
241110-w1l8esscjr 1010/11/2024, 18:22
241110-wzvheaseqb 1010/11/2024, 11:35
241110-nqdvasyqal 10Analysis
-
max time kernel
2699s -
max time network
2697s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
10/11/2024, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
Test.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Test.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Test.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Test.exe
Resource
win10ltsc2021-20241023-en
General
-
Target
Test.exe
-
Size
4.9MB
-
MD5
8136f991544b48f3f64764ecb8eb7ecb
-
SHA1
81151ada9288fde410a14254554c124ba553cba1
-
SHA256
bfca67785b156c56f5e04edd97f5dfd4b72664facf1a663dbfb6e2662abf032b
-
SHA512
d6703707503014bc90ed52eccad9f4e96d4eae06895975d6c8d66f77f1d1158043cd15bbfb55e0dabfcda2363d7109c25e7b3aa131a4faf5c784e1945d2530fd
-
SSDEEP
98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaT:B/n03MdR8DB0OU0Fp2CYuba
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral4/memory/4088-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-14-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-17-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral4/memory/4088-18-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2328 set thread context of 4088 2328 Test.exe 89 -
resource yara_rule behavioral4/memory/4088-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-14-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-17-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-19-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral4/memory/4088-18-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2328 Test.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4088 explorer.exe Token: SeLockMemoryPrivilege 4088 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2328 wrote to memory of 4088 2328 Test.exe 89 PID 2328 wrote to memory of 4088 2328 Test.exe 89 PID 2328 wrote to memory of 4088 2328 Test.exe 89 PID 2328 wrote to memory of 4088 2328 Test.exe 89 PID 2328 wrote to memory of 4088 2328 Test.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Test.exe"C:\Users\Admin\AppData\Local\Temp\Test.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4088
-