Overview
overview
10Static
static
3UIgt876tUH...67.exe
windows11-21h2-x64
10UIgt876tUH...12.exe
windows11-21h2-x64
10UIgt876tUH...44.exe
windows11-21h2-x64
10UIgt876tUH...85.exe
windows11-21h2-x64
10UIgt876tUH...05.exe
windows11-21h2-x64
10UIgt876tUH...18.exe
windows11-21h2-x64
10UIgt876tUH...55.exe
windows11-21h2-x64
10UIgt876tUH...02.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...36.exe
windows11-21h2-x64
10UIgt876tUH...14.exe
windows11-21h2-x64
10UIgt876tUH...25.exe
windows11-21h2-x64
10UIgt876tUH...78.exe
windows11-21h2-x64
10UIgt876tUH...17.exe
windows11-21h2-x64
10UIgt876tUH...24.exe
windows11-21h2-x64
10UIgt876tUH...75.exe
windows11-21h2-x64
10UIgt876tUH...26.exe
windows11-21h2-x64
10UIgt876tUH...78.exe
windows11-21h2-x64
10UIgt876tUH...21.exe
windows11-21h2-x64
10UIgt876tUH...11.exe
windows11-21h2-x64
10UIgt876tUH...41.exe
windows11-21h2-x64
10UIgt876tUH...83.exe
windows11-21h2-x64
10UIgt876tUH...28.exe
windows11-21h2-x64
10UIgt876tUH...18.exe
windows11-21h2-x64
10UIgt876tUH...40.exe
windows11-21h2-x64
10UIgt876tUH...21.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...00.exe
windows11-21h2-x64
10UIgt876tUH...22.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...94.exe
windows11-21h2-x64
10UIgt876tUH...83.exe
windows11-21h2-x64
10Resubmissions
25/11/2024, 17:13
241125-vrxr5atnbp1025/11/2024, 17:13
241125-vrt18stnbl1025/11/2024, 17:13
241125-vrr7mstnbj1025/11/2024, 09:52
241125-lwjavsxjfn10Analysis
- max time kernel
1798s - max time network
1803s - platform
windows11-21h2_x64 - resource
win11-20241007-en - resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system - submitted
25/11/2024, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/AC5zel3AV7vA8b64BXxHmBpuqvCVrl_793412.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/FZC18z1mmOSrfGmgRohsEa8b87QKyK_004944.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/H9zMDiucu4hoAtgomWFd5CAHBZ89AR_233385.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/IbxyHSgPkKXhHO3XECSuXtrGrP78dY_051705.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/JWPdwAR7tf5F2I2M0XlaUFZpXkDHYS_248818.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SKR8Xe9D0cXCZDZPbZkg8tz0KL8VIp_015702.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SMFjVyESw8I9PTvLFZFVsEVapqgviY_867235.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/T78QQDbK2Slo8gJ2UXctsrxPxHgjGt_467036.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VD0HrhXsggfxjVhZKwKvFcUgZngYpL_725314.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VMaiSLAgN8PSkdeOBll7ujSMJqtL0B_784725.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/YHgiq8V6Fe1kWFfxgebX0tkrZhzCzu_920778.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/d4DRbF4lHfHnECxCaAJjnsHMjvRUuT_697575.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/dH0vwJrfFCMTza8GNwvojfVVLEOsFO_754126.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/g9sj08YZGrYURlSuoHSBfD2nMsxYwq_451878.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/gEGj0hrvo86NOP4C6uFjuQZGc7L9SD_033621.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/i1PZKF5Ty5Z4JG8hL2JcygPplPihXS_988211.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/ksggHuRICgGdy4hFQ7TQRtRAFrmo9g_005883.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/lpxGanhj9mp46k1kUv9pBlExkpxjRo_341428.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/mF2M6MDHwuDSA5ImXG8llsrjkmC05f_743618.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/nAUgDpjI6p9TJ1s2ecjTDpXBQyXXtZ_398840.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/sjcH0YxZZOOsABx58ITvg1uPWbRbE8_934035.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/t5bQ9k2jwSWS8mOCFHDsDjImPq05eW_436400.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/tNL1iZslogiTHVT4WoLJnOIUxfb1y9_736622.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/wNGm7TKEGTauV0JK3s4EJDeiQqLRyr_259035.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/xriqKcYplsVMajrABwapyatwUlnHT5_216294.exe
Resource
win11-20241007-en
windows11-21h2-x64
General
- Target UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe
- Size 4.9MB
- Sample241125-vrt18stnbl
- SHA256 4da1e2e9bace60c9f1aa6bee0a83609d52e3237e5a8ce8cc7c2bd4db27a51889
- MD5 219dd1a404086b1fd00ffc6b738e4df8
- SHA1 64f813a99b7df9255ac5329937b8d287cca7950b
- SHA512 2088fd935a8ca80b240189af1e41ae366eaeb9ba11e232d7d609f91679e861502fbc7d6b899ca9bfc3bf27e13774ee7f96742f4a440c3bb4362a49ee1323fb1e
- SSDEEP 98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTc:B/n03MdR8DB0OU0Fp2CYuba4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Xmrig family
- XMRig Miner payload 12 IoCs
resource yara_rule behavioral15/memory/4300-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-15-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-16-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-20-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-21-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral15/memory/4300-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3196 set thread context of 4300 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe 80 -
resource yara_rule behavioral15/memory/4300-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-15-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-16-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-20-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-21-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral15/memory/4300-19-0x0000000140000000-0x0000000140835000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4300 explorer.exe Token: SeLockMemoryPrivilege 4300 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe 4300 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3196 wrote to memory of 4300 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe 80 PID 3196 wrote to memory of 4300 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe 80 PID 3196 wrote to memory of 4300 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe 80 PID 3196 wrote to memory of 4300 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe 80 PID 3196 wrote to memory of 4300 3196 cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe"C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4300
-