Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 10:10
Behavioral task
behavioral1
Sample
54b0ff694289b98c5478191cf3d448b13addd61c04e6a33ab622b065b3e36ae2.exe
Resource
win7-20241010-en
5 signatures
120 seconds
General
-
Target
54b0ff694289b98c5478191cf3d448b13addd61c04e6a33ab622b065b3e36ae2.exe
-
Size
1.5MB
-
MD5
0a38ea9d2bf9b14d4c53280251afbfd0
-
SHA1
7003e338e0f79ce2949c629084c215ac5b918ca1
-
SHA256
54b0ff694289b98c5478191cf3d448b13addd61c04e6a33ab622b065b3e36ae2
-
SHA512
5a462c5e0a50d2a10fa1af872c7b4b6c3022bc4b8696d7aba4dbcd9c5b2ae78a55d567bc1edd20255bc30e5584816a1f4fdb0f553b56bbdcd26fc520f5b7ce7a
-
SSDEEP
24576:JanwhSe11QSONCpGJCjETPlGC78XCej06sSv8rcbQyfUkjPLtiaJ8:knw9oUUEEDlGUrMjAkFi9
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/2496-2-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-3-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-4-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-5-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-6-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-7-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-8-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-9-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-10-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-11-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-12-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig behavioral1/memory/2496-13-0x000000013FEB0000-0x00000001402A1000-memory.dmp xmrig -
resource yara_rule behavioral1/memory/2496-0-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-2-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-3-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-4-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-5-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-6-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-7-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-8-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-9-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-10-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-11-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-12-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx behavioral1/memory/2496-13-0x000000013FEB0000-0x00000001402A1000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2496 54b0ff694289b98c5478191cf3d448b13addd61c04e6a33ab622b065b3e36ae2.exe Token: SeLockMemoryPrivilege 2496 54b0ff694289b98c5478191cf3d448b13addd61c04e6a33ab622b065b3e36ae2.exe