Overview
overview
10Static
static
3UIgt876tUH...67.exe
windows11-21h2-x64
10UIgt876tUH...12.exe
windows11-21h2-x64
10UIgt876tUH...44.exe
windows11-21h2-x64
10UIgt876tUH...85.exe
windows11-21h2-x64
10UIgt876tUH...05.exe
windows11-21h2-x64
10UIgt876tUH...18.exe
windows11-21h2-x64
10UIgt876tUH...55.exe
windows11-21h2-x64
10UIgt876tUH...02.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...36.exe
windows11-21h2-x64
10UIgt876tUH...14.exe
windows11-21h2-x64
10UIgt876tUH...25.exe
windows11-21h2-x64
10UIgt876tUH...78.exe
windows11-21h2-x64
10UIgt876tUH...17.exe
windows11-21h2-x64
10UIgt876tUH...24.exe
windows11-21h2-x64
10UIgt876tUH...75.exe
windows11-21h2-x64
10UIgt876tUH...26.exe
windows11-21h2-x64
10UIgt876tUH...78.exe
windows11-21h2-x64
10UIgt876tUH...21.exe
windows11-21h2-x64
10UIgt876tUH...11.exe
windows11-21h2-x64
10UIgt876tUH...41.exe
windows11-21h2-x64
10UIgt876tUH...83.exe
windows11-21h2-x64
10UIgt876tUH...28.exe
windows11-21h2-x64
10UIgt876tUH...18.exe
windows11-21h2-x64
10UIgt876tUH...40.exe
windows11-21h2-x64
10UIgt876tUH...21.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...00.exe
windows11-21h2-x64
10UIgt876tUH...22.exe
windows11-21h2-x64
10UIgt876tUH...35.exe
windows11-21h2-x64
10UIgt876tUH...94.exe
windows11-21h2-x64
10UIgt876tUH...83.exe
windows11-21h2-x64
10Resubmissions
25-11-2024 17:16
241125-vtdf9stnhk 1025-11-2024 17:16
241125-vtbbxaxmcz 1024-11-2024 19:50
241124-yj992aslbl 10Analysis
-
max time kernel
1799s -
max time network
1809s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-11-2024 17:16
Static task
static1
Behavioral task
behavioral1
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/56hV33j0Zk26xBRQUKQoibTWMzQ1DO_088267.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/AC5zel3AV7vA8b64BXxHmBpuqvCVrl_793412.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/FZC18z1mmOSrfGmgRohsEa8b87QKyK_004944.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/H9zMDiucu4hoAtgomWFd5CAHBZ89AR_233385.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/IbxyHSgPkKXhHO3XECSuXtrGrP78dY_051705.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/JWPdwAR7tf5F2I2M0XlaUFZpXkDHYS_248818.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/LufhxvbVaYw1RXsbz89wC140KwFWBG_439155.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SKR8Xe9D0cXCZDZPbZkg8tz0KL8VIp_015702.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/SMFjVyESw8I9PTvLFZFVsEVapqgviY_867235.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/T78QQDbK2Slo8gJ2UXctsrxPxHgjGt_467036.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VD0HrhXsggfxjVhZKwKvFcUgZngYpL_725314.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/VMaiSLAgN8PSkdeOBll7ujSMJqtL0B_784725.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/YHgiq8V6Fe1kWFfxgebX0tkrZhzCzu_920778.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/bcnYlT4H88bX2xmChdmk3MT3A9959W_902017.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/cz7gZTgrlXdeXdX0GeVttHKwMvPoBu_100224.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/d4DRbF4lHfHnECxCaAJjnsHMjvRUuT_697575.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/dH0vwJrfFCMTza8GNwvojfVVLEOsFO_754126.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/g9sj08YZGrYURlSuoHSBfD2nMsxYwq_451878.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/gEGj0hrvo86NOP4C6uFjuQZGc7L9SD_033621.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/i1PZKF5Ty5Z4JG8hL2JcygPplPihXS_988211.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/ksggHuRICgGdy4hFQ7TQRtRAFrmo9g_005883.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/lpxGanhj9mp46k1kUv9pBlExkpxjRo_341428.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/mF2M6MDHwuDSA5ImXG8llsrjkmC05f_743618.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/nAUgDpjI6p9TJ1s2ecjTDpXBQyXXtZ_398840.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/pXNS8K9fh2GbsFzm05FSEV0i7gZH1i_700021.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/sjcH0YxZZOOsABx58ITvg1uPWbRbE8_934035.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/t5bQ9k2jwSWS8mOCFHDsDjImPq05eW_436400.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/tNL1iZslogiTHVT4WoLJnOIUxfb1y9_736622.exe
Resource
win11-20241023-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/wNGm7TKEGTauV0JK3s4EJDeiQqLRyr_259035.exe
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/xriqKcYplsVMajrABwapyatwUlnHT5_216294.exe
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976/kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe
-
Size
4.9MB
-
MD5
76b3109cff73b7b11df9eab8a515ddd3
-
SHA1
f2e8f9ecb3162bb286704ad07ea001d220407912
-
SHA256
45d6a7d08655744cb2145d5300226c2c7a97d4654a26f77d87b132bf781fc399
-
SHA512
a08e5151de692c42b2db12a7221e4c831f1e12348e96b34d070a6b04fbf6ee0edefbc000d056d258f252194ae6105353ceba06f34769e4dbb26ee8cf24568e65
-
SSDEEP
98304:BDc6nwsaESMplY63OEVf8J9p72FOUPtekqzFLym3Qs5gREwbubaTP:B/n03MdR8DB0OU0Fp2CYubaj
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral21/memory/3864-6-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-7-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-9-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-10-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-12-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-11-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-13-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-15-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-16-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-19-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-20-0x0000000140000000-0x0000000140835000-memory.dmp xmrig behavioral21/memory/3864-21-0x0000000140000000-0x0000000140835000-memory.dmp xmrig -
Suspicious use of SetThreadContext 1 IoCs
Processes:
kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exedescription pid Process procid_target PID 1944 set thread context of 3864 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe 80 -
Processes:
resource yara_rule behavioral21/memory/3864-1-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-3-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-2-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-4-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-5-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-6-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-7-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-9-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-10-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-12-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-11-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-13-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-15-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-16-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-19-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-20-0x0000000140000000-0x0000000140835000-memory.dmp upx behavioral21/memory/3864-21-0x0000000140000000-0x0000000140835000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exepid Process 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
explorer.exedescription pid Process Token: SeLockMemoryPrivilege 3864 explorer.exe Token: SeLockMemoryPrivilege 3864 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
explorer.exepid Process 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
explorer.exepid Process 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe 3864 explorer.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exedescription pid Process procid_target PID 1944 wrote to memory of 3864 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe 80 PID 1944 wrote to memory of 3864 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe 80 PID 1944 wrote to memory of 3864 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe 80 PID 1944 wrote to memory of 3864 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe 80 PID 1944 wrote to memory of 3864 1944 kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe"C:\Users\Admin\AppData\Local\Temp\UIgt876tUHB876tIUG87tiuG87TijT89h89T879hgiuGH86ijH8976\kFlc4oNw6aamroILD0qpdj04MfSRdC_472441.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3864
-