Resubmissions
12/11/2024, 13:17
241112-qjq76awqck 1012/11/2024, 12:44
241112-pytq6ashmc 1010/11/2024, 18:23
241110-w1vjss1qgt 1010/11/2024, 18:22
241110-wz5y5sscjk 1010/11/2024, 11:05
241110-m61tbsymbm 1010/11/2024, 10:39
241110-mqdzmavjft 1010/11/2024, 09:27
241110-lev84atfrj 1010/11/2024, 09:26
241110-ld6y7svakf 1010/11/2024, 08:49
241110-kq6crswqdr 1010/11/2024, 08:49
241110-kq1ghswqdn 10Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nitro generator.exe
Resource
win7-20240708-en
0 signatures
150 seconds
General
-
Target
Nitro generator.exe
-
Size
4.9MB
-
MD5
8136f991544b48f3f64764ecb8eb7ecb
-
SHA1
81151ada9288fde410a14254554c124ba553cba1
-
SHA256
bfca67785b156c56f5e04edd97f5dfd4b72664facf1a663dbfb6e2662abf032b
-
SHA512
d6703707503014bc90ed52eccad9f4e96d4eae06895975d6c8d66f77f1d1158043cd15bbfb55e0dabfcda2363d7109c25e7b3aa131a4faf5c784e1945d2530fd
-
SSDEEP
98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaT:B/n03MdR8DB0OU0Fp2CYuba
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral2/memory/1360-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-14-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-17-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-18-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral2/memory/1360-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1284 set thread context of 1360 1284 Nitro generator.exe 94 -
resource yara_rule behavioral2/memory/1360-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-14-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-17-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-18-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral2/memory/1360-19-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1284 Nitro generator.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1360 explorer.exe Token: SeLockMemoryPrivilege 1360 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1360 1284 Nitro generator.exe 94 PID 1284 wrote to memory of 1360 1284 Nitro generator.exe 94 PID 1284 wrote to memory of 1360 1284 Nitro generator.exe 94 PID 1284 wrote to memory of 1360 1284 Nitro generator.exe 94 PID 1284 wrote to memory of 1360 1284 Nitro generator.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nitro generator.exe"C:\Users\Admin\AppData\Local\Temp\Nitro generator.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360
-