Resubmissions

25-11-2024 17:07

241125-vnfpfaxkax 10

25-11-2024 17:07

241125-vndvvaxkav 10

25-11-2024 17:07

241125-vnbqgstlfl 10

25-11-2024 09:55

241125-lxskxsxkcn 10

Analysis

  • max time kernel
    1799s
  • max time network
    1801s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-uk
  • resource tags

    arch:x64arch:x86image:win11-20241007-uklocale:uk-uaos:windows11-21h2-x64systemwindows
  • submitted
    25-11-2024 17:07

General

  • Target

    UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe

  • Size

    4.9MB

  • MD5

    b55e6b477ca8940e725bbe11472c8de9

  • SHA1

    e2907125b20872929513955928965d7dfdd677c0

  • SHA256

    34a1af6f382d625751970df7b954184de8d15cc96218a99cd2fbbd31534c39b0

  • SHA512

    da80e4c2741592059b7aa572d8c726acc2bb3325ca85413e7bc093759ca9d21cbd5c830e03fe9e49e73d6affee84da38c22c6a47452c7cb8d259fd66e359c0a9

  • SSDEEP

    98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTk:B/n03MdR8DB0OU0Fp2CYubag

Score
10/10

Malware Config

Signatures

  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 15 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
    "C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\explorer.exe
      explorer.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3600-4-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-3-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-5-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-1-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-8-0x0000000002A80000-0x0000000002AA0000-memory.dmp

    Filesize

    128KB

  • memory/3600-7-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-2-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-6-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-9-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-12-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-11-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-13-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-10-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-14-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-16-0x0000000002AB0000-0x0000000002AD0000-memory.dmp

    Filesize

    128KB

  • memory/3600-17-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-18-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-19-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-20-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-21-0x00000000131B0000-0x00000000131D0000-memory.dmp

    Filesize

    128KB

  • memory/3600-22-0x00000000131B0000-0x00000000131D0000-memory.dmp

    Filesize

    128KB

  • memory/3600-24-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-25-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-23-0x0000000140000000-0x0000000140835000-memory.dmp

    Filesize

    8.2MB

  • memory/3600-27-0x00000000134C0000-0x00000000134E0000-memory.dmp

    Filesize

    128KB

  • memory/3600-28-0x00000000134E0000-0x0000000013500000-memory.dmp

    Filesize

    128KB

  • memory/3600-29-0x00000000134C0000-0x00000000134E0000-memory.dmp

    Filesize

    128KB

  • memory/3600-30-0x00000000134E0000-0x0000000013500000-memory.dmp

    Filesize

    128KB