Overview
overview
10Static
static
3Triage-32/...2).exe
windows10-2004-x64
10Triage-32/...3).exe
windows10-2004-x64
10Triage-32/...4).exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test.exe
windows10-2004-x64
10Triage-32/...2).exe
windows10-2004-x64
10Triage-32/...3).exe
windows10-2004-x64
10Triage-32/...4).exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test2.exe
windows10-2004-x64
10Triage-32/...2).exe
windows10-2004-x64
10Triage-32/...3).exe
windows10-2004-x64
10Triage-32/...4).exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test3.exe
windows10-2004-x64
10Triage-32/...2).exe
windows10-2004-x64
10Triage-32/...3).exe
windows10-2004-x64
10Triage-32/...4).exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test4.exe
windows10-2004-x64
10Triage-32/...2).exe
windows10-2004-x64
10Triage-32/...3).exe
windows10-2004-x64
10Triage-32/...4).exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test5.exe
windows10-2004-x64
10Triage-32/...2).exe
windows10-2004-x64
10Triage-32/...3).exe
windows10-2004-x64
10Triage-32/...4).exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test6.exe
windows10-2004-x64
10Triage-32/...py.exe
windows10-2004-x64
10Triage-32/Test7.exe
windows10-2004-x64
10Resubmissions
18-11-2024 07:16
241118-h34nla1ndz 1018-11-2024 07:15
241118-h3fa1a1gla 1018-11-2024 06:50
241118-hme1as1kby 1018-11-2024 06:50
241118-hl24fawlgj 1018-11-2024 06:49
241118-hllfpawlfl 1018-11-2024 06:48
241118-hk7mja1cra 1018-11-2024 02:45
241118-c856qawekd 1018-11-2024 02:44
241118-c8ec1a1par 1018-11-2024 02:43
241118-c723nswlav 10Analysis
-
max time kernel
1800s -
max time network
1811s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
Triage-32/Test - Copy (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Triage-32/Test - Copy (3).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Triage-32/Test - Copy (4).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
Triage-32/Test - Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Triage-32/Test.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
Triage-32/Test2 - Copy (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Triage-32/Test2 - Copy (3).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
Triage-32/Test2 - Copy (4).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Triage-32/Test2 - Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
Triage-32/Test2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Triage-32/Test3 - Copy (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
Triage-32/Test3 - Copy (3).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Triage-32/Test3 - Copy (4).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
Triage-32/Test3 - Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Triage-32/Test3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
Triage-32/Test4 - Copy (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Triage-32/Test4 - Copy (3).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
Triage-32/Test4 - Copy (4).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Triage-32/Test4 - Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
Triage-32/Test4.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Triage-32/Test5 - Copy (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
Triage-32/Test5 - Copy (3).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Triage-32/Test5 - Copy (4).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
Triage-32/Test5 - Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Triage-32/Test5.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
Triage-32/Test6 - Copy (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Triage-32/Test6 - Copy (3).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
Triage-32/Test6 - Copy (4).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Triage-32/Test6 - Copy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
Triage-32/Test6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Triage-32/Test7 - Copy.exe
Resource
win10v2004-20241007-en
General
-
Target
Triage-32/Test3.exe
-
Size
4.9MB
-
MD5
8136f991544b48f3f64764ecb8eb7ecb
-
SHA1
81151ada9288fde410a14254554c124ba553cba1
-
SHA256
bfca67785b156c56f5e04edd97f5dfd4b72664facf1a663dbfb6e2662abf032b
-
SHA512
d6703707503014bc90ed52eccad9f4e96d4eae06895975d6c8d66f77f1d1158043cd15bbfb55e0dabfcda2363d7109c25e7b3aa131a4faf5c784e1945d2530fd
-
SSDEEP
98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaT:B/n03MdR8DB0OU0Fp2CYuba
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral15/memory/1588-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-14-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-17-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-18-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/1588-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3692 set thread context of 1588 3692 Test3.exe 97 -
resource yara_rule behavioral15/memory/1588-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-14-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-17-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-18-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/1588-19-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3692 Test3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1588 explorer.exe Token: SeLockMemoryPrivilege 1588 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3692 wrote to memory of 1588 3692 Test3.exe 97 PID 3692 wrote to memory of 1588 3692 Test3.exe 97 PID 3692 wrote to memory of 1588 3692 Test3.exe 97 PID 3692 wrote to memory of 1588 3692 Test3.exe 97 PID 3692 wrote to memory of 1588 3692 Test3.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Triage-32\Test3.exe"C:\Users\Admin\AppData\Local\Temp\Triage-32\Test3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588
-