Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2024, 04:33 UTC
Behavioral task
behavioral1
Sample
62d04043314444de12f5098570162ed15720b424af41ffcfb02bd0bb44cefa69.exe
Resource
win7-20240903-en
5 signatures
120 seconds
General
-
Target
62d04043314444de12f5098570162ed15720b424af41ffcfb02bd0bb44cefa69.exe
-
Size
1.5MB
-
MD5
1859bb4d87dcfb644c62bb63a4c61f81
-
SHA1
9937e90107034fc6e78e6627fa9824e8828c8e65
-
SHA256
62d04043314444de12f5098570162ed15720b424af41ffcfb02bd0bb44cefa69
-
SHA512
e8d8acee6e062a06d3bb174fb5ecb7871b69c8078f177194008a7914cf73e6e8d9ca50c63d607cc30a6e105ffe09cde0bcadf9564f964233f81411131e4ff163
-
SSDEEP
24576:JanwhSe11QSONCpGJCjETPlGC78XIHbAYhbc8lFad+tsytA7WEXLsh:knw9oUUEEDlGUJ8Y9c87MQosh
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral2/memory/2936-2-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-3-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-4-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-5-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-6-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-7-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-8-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-9-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-10-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-11-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-12-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig behavioral2/memory/2936-13-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp xmrig -
resource yara_rule behavioral2/memory/2936-0-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-2-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-3-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-4-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-5-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-6-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-7-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-8-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-9-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-10-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-11-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-12-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx behavioral2/memory/2936-13-0x00007FF7BDA40000-0x00007FF7BDE31000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2936 62d04043314444de12f5098570162ed15720b424af41ffcfb02bd0bb44cefa69.exe Token: SeLockMemoryPrivilege 2936 62d04043314444de12f5098570162ed15720b424af41ffcfb02bd0bb44cefa69.exe
Processes
Network
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request4.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request92.12.20.2.in-addr.arpaIN PTRResponse92.12.20.2.in-addr.arpaIN PTRa2-20-12-92deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
208 B 4
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
4.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
228.249.119.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
92.12.20.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa