Overview
overview
10Static
static
3UIgt876tUH...67.exe
windows11-21h2-x64
10UIgt876tUH...12.exe
windows11-21h2-x64
10UIgt876tUH...44.exe
windows11-21h2-x64
10UIgt876tUH...85.exe
windows11-21h2-x64
10UIgt876tUH...05.exe
windows11-21h2-x64
10UIgt876tUH...18.exe
windows11-21h2-x64
10UIgt876tUH...55.exe
windows11-21h2-x64
10UIgt876tUH...02.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...36.exe
windows11-21h2-x64
10UIgt876tUH...14.exe
windows11-21h2-x64
10UIgt876tUH...25.exe
windows11-21h2-x64
10UIgt876tUH...78.exe
windows11-21h2-x64
10UIgt876tUH...17.exe
windows11-21h2-x64
10UIgt876tUH...24.exe
windows11-21h2-x64
10UIgt876tUH...75.exe
windows11-21h2-x64
10UIgt876tUH...26.exe
windows11-21h2-x64
10UIgt876tUH...78.exe
windows11-21h2-x64
10UIgt876tUH...21.exe
windows11-21h2-x64
10UIgt876tUH...11.exe
windows11-21h2-x64
10UIgt876tUH...41.exe
windows11-21h2-x64
10UIgt876tUH...83.exe
windows11-21h2-x64
10UIgt876tUH...28.exe
windows11-21h2-x64
10UIgt876tUH...18.exe
windows11-21h2-x64
10UIgt876tUH...40.exe
windows11-21h2-x64
10UIgt876tUH...21.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...00.exe
windows11-21h2-x64
10UIgt876tUH...22.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...94.exe
windows11-21h2-x64
10UIgt876tUH...83.exe
windows11-21h2-x64
10Resubmissions
25-11-2024 17:13
241125-vrxr5atnbp 1025-11-2024 17:13
241125-vrt18stnbl 1025-11-2024 17:13
241125-vrr7mstnbj 1025-11-2024 09:52
241125-lwjavsxjfn 10Analysis
-
max time kernel
1800s -
max time network
1800s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-11-2024 17:13
Static task
static1
Behavioral task
behavioral1
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/AC5zel3AV7vA8b64BXxHmBpuqvCVrl_793412.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/FZC18z1mmOSrfGmgRohsEa8b87QKyK_004944.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/H9zMDiucu4hoAtgomWFd5CAHBZ89AR_233385.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/IbxyHSgPkKXhHO3XECSuXtrGrP78dY_051705.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/JWPdwAR7tf5F2I2M0XlaUFZpXkDHYS_248818.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SKR8Xe9D0cXCZDZPbZkg8tz0KL8VIp_015702.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SMFjVyESw8I9PTvLFZFVsEVapqgviY_867235.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/T78QQDbK2Slo8gJ2UXctsrxPxHgjGt_467036.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VD0HrhXsggfxjVhZKwKvFcUgZngYpL_725314.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VMaiSLAgN8PSkdeOBll7ujSMJqtL0B_784725.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/YHgiq8V6Fe1kWFfxgebX0tkrZhzCzu_920778.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/d4DRbF4lHfHnECxCaAJjnsHMjvRUuT_697575.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/dH0vwJrfFCMTza8GNwvojfVVLEOsFO_754126.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/g9sj08YZGrYURlSuoHSBfD2nMsxYwq_451878.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/gEGj0hrvo86NOP4C6uFjuQZGc7L9SD_033621.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/i1PZKF5Ty5Z4JG8hL2JcygPplPihXS_988211.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/ksggHuRICgGdy4hFQ7TQRtRAFrmo9g_005883.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/lpxGanhj9mp46k1kUv9pBlExkpxjRo_341428.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/mF2M6MDHwuDSA5ImXG8llsrjkmC05f_743618.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/nAUgDpjI6p9TJ1s2ecjTDpXBQyXXtZ_398840.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/sjcH0YxZZOOsABx58ITvg1uPWbRbE8_934035.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/t5bQ9k2jwSWS8mOCFHDsDjImPq05eW_436400.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/tNL1iZslogiTHVT4WoLJnOIUxfb1y9_736622.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/wNGm7TKEGTauV0JK3s4EJDeiQqLRyr_259035.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/xriqKcYplsVMajrABwapyatwUlnHT5_216294.exe
Resource
win11-20241023-en
windows11-21h2-x64
General
-
Target
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe
-
Size
4.9MB
-
MD5
3f0d1fe09b5afa96f74ff1ea5658b77b
-
SHA1
c4cd8b6003757f52988e4610864d41b74f54c887
-
SHA256
94090dd85ec5e90bb4ba0dc8d9801491878a9a0ae349e70d3e2bc4cfb1f2b0c7
-
SHA512
274fa56737ac8b0e127606f263c4584fae94615a091d7d07944bcdbc5773d8e3e2d40232cf4ccc0e59cfb635f74454e012acef571c1cbfb3a7a4d168f3b2e46f
-
SSDEEP
98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTl:B/n03MdR8DB0OU0Fp2CYubax
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 16 IoCs
resource yara_rule behavioral26/memory/3340-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-14-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-15-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-17-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-18-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-20-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-24-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-25-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral26/memory/3340-23-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1196 set thread context of 3340 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe 77 -
resource yara_rule behavioral26/memory/3340-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-14-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-15-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-17-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-18-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-19-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-20-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-24-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-25-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral26/memory/3340-23-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 3340 explorer.exe Token: SeLockMemoryPrivilege 3340 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe 3340 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1196 wrote to memory of 3340 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe 77 PID 1196 wrote to memory of 3340 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe 77 PID 1196 wrote to memory of 3340 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe 77 PID 1196 wrote to memory of 3340 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe 77 PID 1196 wrote to memory of 3340 1196 pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe"C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3340
-